GroupMapper

# keycloak.ldap.GroupMapper

Allows for creating and managing group mappers for Keycloak users federated via LDAP.

The LDAP group mapper can be used to map an LDAP user’s groups from some DN to Keycloak groups. This group mapper will also create the groups within Keycloak if they do not already exist.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    enabled: true,
    realm: "test",
});
const ldapUserFederation = new keycloak.ldap.UserFederation("ldap_user_federation", {
    bindCredential: "admin",
    bindDn: "cn=admin,dc=example,dc=org",
    connectionUrl: "ldap://openldap",
    rdnLdapAttribute: "cn",
    realmId: realm.id,
    userObjectClasses: [
        "simpleSecurityObject",
        "organizationalRole",
    ],
    usernameLdapAttribute: "cn",
    usersDn: "dc=example,dc=org",
    uuidLdapAttribute: "entryDN",
});
const ldapGroupMapper = new keycloak.ldap.GroupMapper("ldap_group_mapper", {
    groupNameLdapAttribute: "cn",
    groupObjectClasses: ["groupOfNames"],
    ldapGroupsDn: "dc=example,dc=org",
    ldapUserFederationId: ldapUserFederation.id,
    memberofLdapAttribute: "memberOf",
    membershipAttributeType: "DN",
    membershipLdapAttribute: "member",
    membershipUserLdapAttribute: "cn",
    realmId: realm.id,
});

import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    enabled=True,
    realm="test")
ldap_user_federation = keycloak.ldap.UserFederation("ldapUserFederation",
    bind_credential="admin",
    bind_dn="cn=admin,dc=example,dc=org",
    connection_url="ldap://openldap",
    rdn_ldap_attribute="cn",
    realm_id=realm.id,
    user_object_classes=[
        "simpleSecurityObject",
        "organizationalRole",
    ],
    username_ldap_attribute="cn",
    users_dn="dc=example,dc=org",
    uuid_ldap_attribute="entryDN")
ldap_group_mapper = keycloak.ldap.GroupMapper("ldapGroupMapper",
    group_name_ldap_attribute="cn",
    group_object_classes=["groupOfNames"],
    ldap_groups_dn="dc=example,dc=org",
    ldap_user_federation_id=ldap_user_federation.id,
    memberof_ldap_attribute="memberOf",
    membership_attribute_type="DN",
    membership_ldap_attribute="member",
    membership_user_ldap_attribute="cn",
    realm_id=realm.id)

using Pulumi;
using Keycloak = Pulumi.Keycloak;

class MyStack : Stack
{
    public MyStack()
    {
        var realm = new Keycloak.Realm("realm", new Keycloak.RealmArgs
        {
            Enabled = true,
            Realm = "test",
        });
        var ldapUserFederation = new Keycloak.Ldap.UserFederation("ldapUserFederation", new Keycloak.Ldap.UserFederationArgs
        {
            BindCredential = "admin",
            BindDn = "cn=admin,dc=example,dc=org",
            ConnectionUrl = "ldap://openldap",
            RdnLdapAttribute = "cn",
            RealmId = realm.Id,
            UserObjectClasses = 
            {
                "simpleSecurityObject",
                "organizationalRole",
            },
            UsernameLdapAttribute = "cn",
            UsersDn = "dc=example,dc=org",
            UuidLdapAttribute = "entryDN",
        });
        var ldapGroupMapper = new Keycloak.Ldap.GroupMapper("ldapGroupMapper", new Keycloak.Ldap.GroupMapperArgs
        {
            GroupNameLdapAttribute = "cn",
            GroupObjectClasses = 
            {
                "groupOfNames",
            },
            LdapGroupsDn = "dc=example,dc=org",
            LdapUserFederationId = ldapUserFederation.Id,
            MemberofLdapAttribute = "memberOf",
            MembershipAttributeType = "DN",
            MembershipLdapAttribute = "member",
            MembershipUserLdapAttribute = "cn",
            RealmId = realm.Id,
        });
    }

}

Argument Reference

The following arguments are supported:

realm_id - (Required) The realm that this LDAP mapper will exist in.
ldap_user_federation_id - (Required) The ID of the LDAP user federation provider to attach this mapper to.
name - (Required) Display name of this mapper when displayed in the console.
ldap_groups_dn - (Required) The LDAP DN where groups can be found.
group_name_ldap_attribute - (Required) The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
group_object_classes - (Required) Array of strings representing the object classes for the group. Must contain at least one.
preserve_group_inheritance - (Optional) When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
ignore_missing_groups - (Optional) When true, missing groups in the hierarchy will be ignored.
membership_ldap_attribute - (Required) The name of the LDAP attribute that is used for membership mappings.
membership_attribute_type - (Optional) Can be one of DN or UID. Defaults to DN.
membership_user_ldap_attribute - (Required) The name of the LDAP attribute on a user that is used for membership mappings.
groups_ldap_filter - (Optional) When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).
mode - (Optional) Can be one of READ_ONLY or LDAP_ONLY. Defaults to READ_ONLY.
user_roles_retrieve_strategy - (Optional) Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
memberof_ldap_attribute - (Optional) Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
mapped_group_attributes - (Optional) Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
drop_non_existing_groups_during_sync - (Optional) When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

Create a GroupMapper Resource

new GroupMapper(name: string, args: GroupMapperArgs, opts?: CustomResourceOptions);

def GroupMapper(resource_name, opts=None, drop_non_existing_groups_during_sync=None, group_name_ldap_attribute=None, group_object_classes=None, groups_ldap_filter=None, ignore_missing_groups=None, ldap_groups_dn=None, ldap_user_federation_id=None, mapped_group_attributes=None, memberof_ldap_attribute=None, membership_attribute_type=None, membership_ldap_attribute=None, membership_user_ldap_attribute=None, mode=None, name=None, preserve_group_inheritance=None, realm_id=None, user_roles_retrieve_strategy=None, __props__=None);

func NewGroupMapper(ctx *Context, name string, args GroupMapperArgs, opts ...ResourceOption) (*GroupMapper, error)

public GroupMapper(string name, GroupMapperArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args GroupMapperArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args GroupMapperArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args GroupMapperArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

GroupMapper Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The GroupMapper resource accepts the following input properties:

GroupNameLdapAttribute string
GroupObjectClasses List<string>
LdapGroupsDn string
LdapUserFederationId string: The ldap user federation provider to attach this mapper to.
MembershipLdapAttribute string
MembershipUserLdapAttribute string
RealmId string: The realm in which the ldap user federation provider exists.
DropNonExistingGroupsDuringSync bool
GroupsLdapFilter string
IgnoreMissingGroups bool
MappedGroupAttributes List<string>
MemberofLdapAttribute string
MembershipAttributeType string
Mode string
Name string: Display name of the mapper when displayed in the console.
PreserveGroupInheritance bool
UserRolesRetrieveStrategy string

GroupNameLdapAttribute string
GroupObjectClasses []string
LdapGroupsDn string
LdapUserFederationId string: The ldap user federation provider to attach this mapper to.
MembershipLdapAttribute string
MembershipUserLdapAttribute string
RealmId string: The realm in which the ldap user federation provider exists.
DropNonExistingGroupsDuringSync bool
GroupsLdapFilter string
IgnoreMissingGroups bool
MappedGroupAttributes []string
MemberofLdapAttribute string
MembershipAttributeType string
Mode string
Name string: Display name of the mapper when displayed in the console.
PreserveGroupInheritance bool
UserRolesRetrieveStrategy string

groupNameLdapAttribute string
groupObjectClasses string[]
ldapGroupsDn string
ldapUserFederationId string: The ldap user federation provider to attach this mapper to.
membershipLdapAttribute string
membershipUserLdapAttribute string
realmId string: The realm in which the ldap user federation provider exists.
dropNonExistingGroupsDuringSync boolean
groupsLdapFilter string
ignoreMissingGroups boolean
mappedGroupAttributes string[]
memberofLdapAttribute string
membershipAttributeType string
mode string
name string: Display name of the mapper when displayed in the console.
preserveGroupInheritance boolean
userRolesRetrieveStrategy string

group_name_ldap_attribute str
group_object_classes List[str]
ldap_groups_dn str
ldap_user_federation_id str: The ldap user federation provider to attach this mapper to.
membership_ldap_attribute str
membership_user_ldap_attribute str
realm_id str: The realm in which the ldap user federation provider exists.
drop_non_existing_groups_during_sync bool
groups_ldap_filter str
ignore_missing_groups bool
mapped_group_attributes List[str]
memberof_ldap_attribute str
membership_attribute_type str
mode str
name str: Display name of the mapper when displayed in the console.
preserve_group_inheritance bool
user_roles_retrieve_strategy str

Outputs

All input properties are implicitly available as output properties. Additionally, the GroupMapper resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing GroupMapper Resource

Get an existing GroupMapper resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupMapperState, opts?: CustomResourceOptions): GroupMapper

static get(resource_name, id, opts=None, drop_non_existing_groups_during_sync=None, group_name_ldap_attribute=None, group_object_classes=None, groups_ldap_filter=None, ignore_missing_groups=None, ldap_groups_dn=None, ldap_user_federation_id=None, mapped_group_attributes=None, memberof_ldap_attribute=None, membership_attribute_type=None, membership_ldap_attribute=None, membership_user_ldap_attribute=None, mode=None, name=None, preserve_group_inheritance=None, realm_id=None, user_roles_retrieve_strategy=None, __props__=None);

func GetGroupMapper(ctx *Context, name string, id IDInput, state *GroupMapperState, opts ...ResourceOption) (*GroupMapper, error)

public static GroupMapper Get(string name, Input<string> id, GroupMapperState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

DropNonExistingGroupsDuringSync bool
GroupNameLdapAttribute string
GroupObjectClasses List<string>
GroupsLdapFilter string
IgnoreMissingGroups bool
LdapGroupsDn string
LdapUserFederationId string: The ldap user federation provider to attach this mapper to.
MappedGroupAttributes List<string>
MemberofLdapAttribute string
MembershipAttributeType string
MembershipLdapAttribute string
MembershipUserLdapAttribute string
Mode string
Name string: Display name of the mapper when displayed in the console.
PreserveGroupInheritance bool
RealmId string: The realm in which the ldap user federation provider exists.
UserRolesRetrieveStrategy string

DropNonExistingGroupsDuringSync bool
GroupNameLdapAttribute string
GroupObjectClasses []string
GroupsLdapFilter string
IgnoreMissingGroups bool
LdapGroupsDn string
LdapUserFederationId string: The ldap user federation provider to attach this mapper to.
MappedGroupAttributes []string
MemberofLdapAttribute string
MembershipAttributeType string
MembershipLdapAttribute string
MembershipUserLdapAttribute string
Mode string
Name string: Display name of the mapper when displayed in the console.
PreserveGroupInheritance bool
RealmId string: The realm in which the ldap user federation provider exists.
UserRolesRetrieveStrategy string

dropNonExistingGroupsDuringSync boolean
groupNameLdapAttribute string
groupObjectClasses string[]
groupsLdapFilter string
ignoreMissingGroups boolean
ldapGroupsDn string
ldapUserFederationId string: The ldap user federation provider to attach this mapper to.
mappedGroupAttributes string[]
memberofLdapAttribute string
membershipAttributeType string
membershipLdapAttribute string
membershipUserLdapAttribute string
mode string
name string: Display name of the mapper when displayed in the console.
preserveGroupInheritance boolean
realmId string: The realm in which the ldap user federation provider exists.
userRolesRetrieveStrategy string

drop_non_existing_groups_during_sync bool
group_name_ldap_attribute str
group_object_classes List[str]
groups_ldap_filter str
ignore_missing_groups bool
ldap_groups_dn str
ldap_user_federation_id str: The ldap user federation provider to attach this mapper to.
mapped_group_attributes List[str]
memberof_ldap_attribute str
membership_attribute_type str
membership_ldap_attribute str
membership_user_ldap_attribute str
mode str
name str: Display name of the mapper when displayed in the console.
preserve_group_inheritance bool
realm_id str: The realm in which the ldap user federation provider exists.
user_roles_retrieve_strategy str

Package Details

Repository: https://github.com/pulumi/pulumi-keycloak
License: Apache-2.0
Notes: This Pulumi package is based on the keycloak Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud