User federation with Google secure ldaps - no luck

Configuring the server
1

I’m using a Mac, latest version of Keycloak in standalone and I installed java jdk 8u66.
I’m trying to implement Google secure ldap for user federation in Keycloak. I enabled LDAP service in the Google admin and downloaded the certificate (crt) and private key.

Then I added the certificate and private key in the Java cacerts keystore as PKCS #8. I also to tried to add the private key to the crt file and add the crt file to java cacerts keystore. Cacert is located: home/jre/lib/security/cacerts.

I also tried to my make own java keystore and adapted the standalone.xml file but no luck. … can’t find path… was the error in the server.log.

My settings (in a tenant - not in master):

The connection url: ldaps://ldap.google.com
edit mode: read only
users DN: dc=xxxx,dc=xx (no filter applied)
search scope: subtree
Bind type:
When I set it to ‘none’ I get error: “error during sync of users” in server log:
error code 50: insufficient access rights
Uncaught server error: LDAP query failed.

When I enter a user:
User + @domain = LDAP: error 50 - Not authorized to authenticate password
User without @domain = error 49 - Incorrect password
User in DN = uid or cn=xxxx, ou=xxxx - error 50 - Not authorized to authenticate password

My question is: what is the correct setting for bind type? Add both the crt and private key as PKCS #8 in the java cacerts keystore is correct? I also tried with a new certificate.

If anyone has an idea what is wrong? Thanks!

2 Likes
2

Hi @illoinventore ,
i don’t know if you fix your problem, i have the same, any help :pray:

1 Like
3

Does any one have a solution for this?

4

I found a solution for this: You can use stunnel to create an endpoint that keycloak can use without the certificate (or any authentication for that matter, so keep your firewall tightly closed for stunnel’s port).

More Details are on the bottom of this page:

6

Keycloak supports authentication (the certificate needs to be added to the cacert Java file or to Keycloak’s truststores), but I encountered the same issue as @illoinventore and @Badr.me . Why doesn’t Keycloak support synchronization with Google LDAPS like active directory?