Automaticly assign groups to users based on OU

Hello Keycloak

We just imported all our users from our AD into Keycloak using LDAP.

What I am looking to do is, create a mapping that will put users in groups within Keycloak according to their OU groups.

I am pretty new to keycloak, so I apologize if it is a very novice questions :blush:

I am afraid that I don’t understand your question. Can you give an example of what you have and what you keycloak wanted to do?

We want our imported users to get assigned groups relative to our AD structure automatically.

Based on the OU path that comes with the imported user, but I am having trouble defining the parameters, and I am not sure it is even possible.

If it is to be done, I think it is using the “Group-LDAP-mapper”.
I tried but the users are not being put into the groups. So I assume that I am putting in the wrong parameters.

I will give you an example.

We have 3 IT levels

Level 1, level 2 and level 3

they are sorted in AD groups and the groups and users are imported using LDAP. But the users aren’t assigned their respective groups from our AD.

And now I am trying to use a mapper to get them assigned. But I am not sure it’s the correct way.

When a user is imported it has a User attribute that i called “LDAP_ENTRY_DN” and looks something like this

“CN=NameOfUser,OU=XXXXXX,OU=XXXXX=,DC=NameOfDC,DC=local”

and it’s from this attribute that I would like to map them in to groups.

This is as far as I know keycloak not possible out of the box, but I think that there is a way to do this with a custom plugin to extract the ou path of the user and map that to groups

That does sound quite promising, I had been riping my hair out haha :slight_smile:

Do you know what plugin exactly this requires?

You have to create one yourselves. I would probably start with an extension on the AbstractLDAPStorageMapperFactory. There are online resources how to build your own extension in keycloak.