Keycloak

v4.11.0 published on Thursday, Aug 4, 2022 by Pulumi

GroupMapper

Allows for creating and managing group mappers for Keycloak users federated via LDAP.

The LDAP group mapper can be used to map an LDAP user’s groups from some DN to Keycloak groups. This group mapper will also create the groups within Keycloak if they do not already exist.

Example Usage

using Pulumi;
using Keycloak = Pulumi.Keycloak;

class MyStack : Stack
{
    public MyStack()
    {
        var realm = new Keycloak.Realm("realm", new Keycloak.RealmArgs
        {
            RealmName = "my-realm",
            Enabled = true,
        });
        var ldapUserFederation = new Keycloak.Ldap.UserFederation("ldapUserFederation", new Keycloak.Ldap.UserFederationArgs
        {
            RealmId = realm.Id,
            UsernameLdapAttribute = "cn",
            RdnLdapAttribute = "cn",
            UuidLdapAttribute = "entryDN",
            UserObjectClasses = 
            {
                "simpleSecurityObject",
                "organizationalRole",
            },
            ConnectionUrl = "ldap://openldap",
            UsersDn = "dc=example,dc=org",
            BindDn = "cn=admin,dc=example,dc=org",
            BindCredential = "admin",
        });
        var ldapGroupMapper = new Keycloak.Ldap.GroupMapper("ldapGroupMapper", new Keycloak.Ldap.GroupMapperArgs
        {
            RealmId = realm.Id,
            LdapUserFederationId = ldapUserFederation.Id,
            LdapGroupsDn = "dc=example,dc=org",
            GroupNameLdapAttribute = "cn",
            GroupObjectClasses = 
            {
                "groupOfNames",
            },
            MembershipAttributeType = "DN",
            MembershipLdapAttribute = "member",
            MembershipUserLdapAttribute = "cn",
            MemberofLdapAttribute = "memberOf",
        });
    }

}
package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v4/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v4/go/keycloak/ldap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		ldapUserFederation, err := ldap.NewUserFederation(ctx, "ldapUserFederation", &ldap.UserFederationArgs{
			RealmId:               realm.ID(),
			UsernameLdapAttribute: pulumi.String("cn"),
			RdnLdapAttribute:      pulumi.String("cn"),
			UuidLdapAttribute:     pulumi.String("entryDN"),
			UserObjectClasses: pulumi.StringArray{
				pulumi.String("simpleSecurityObject"),
				pulumi.String("organizationalRole"),
			},
			ConnectionUrl:  pulumi.String("ldap://openldap"),
			UsersDn:        pulumi.String("dc=example,dc=org"),
			BindDn:         pulumi.String("cn=admin,dc=example,dc=org"),
			BindCredential: pulumi.String("admin"),
		})
		if err != nil {
			return err
		}
		_, err = ldap.NewGroupMapper(ctx, "ldapGroupMapper", &ldap.GroupMapperArgs{
			RealmId:                realm.ID(),
			LdapUserFederationId:   ldapUserFederation.ID(),
			LdapGroupsDn:           pulumi.String("dc=example,dc=org"),
			GroupNameLdapAttribute: pulumi.String("cn"),
			GroupObjectClasses: pulumi.StringArray{
				pulumi.String("groupOfNames"),
			},
			MembershipAttributeType:     pulumi.String("DN"),
			MembershipLdapAttribute:     pulumi.String("member"),
			MembershipUserLdapAttribute: pulumi.String("cn"),
			MemberofLdapAttribute:       pulumi.String("memberOf"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.ldap.UserFederation;
import com.pulumi.keycloak.ldap.UserFederationArgs;
import com.pulumi.keycloak.ldap.GroupMapper;
import com.pulumi.keycloak.ldap.GroupMapperArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()        
            .realm("my-realm")
            .enabled(true)
            .build());

        var ldapUserFederation = new UserFederation("ldapUserFederation", UserFederationArgs.builder()        
            .realmId(realm.id())
            .usernameLdapAttribute("cn")
            .rdnLdapAttribute("cn")
            .uuidLdapAttribute("entryDN")
            .userObjectClasses(            
                "simpleSecurityObject",
                "organizationalRole")
            .connectionUrl("ldap://openldap")
            .usersDn("dc=example,dc=org")
            .bindDn("cn=admin,dc=example,dc=org")
            .bindCredential("admin")
            .build());

        var ldapGroupMapper = new GroupMapper("ldapGroupMapper", GroupMapperArgs.builder()        
            .realmId(realm.id())
            .ldapUserFederationId(ldapUserFederation.id())
            .ldapGroupsDn("dc=example,dc=org")
            .groupNameLdapAttribute("cn")
            .groupObjectClasses("groupOfNames")
            .membershipAttributeType("DN")
            .membershipLdapAttribute("member")
            .membershipUserLdapAttribute("cn")
            .memberofLdapAttribute("memberOf")
            .build());

    }
}
import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
ldap_user_federation = keycloak.ldap.UserFederation("ldapUserFederation",
    realm_id=realm.id,
    username_ldap_attribute="cn",
    rdn_ldap_attribute="cn",
    uuid_ldap_attribute="entryDN",
    user_object_classes=[
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connection_url="ldap://openldap",
    users_dn="dc=example,dc=org",
    bind_dn="cn=admin,dc=example,dc=org",
    bind_credential="admin")
ldap_group_mapper = keycloak.ldap.GroupMapper("ldapGroupMapper",
    realm_id=realm.id,
    ldap_user_federation_id=ldap_user_federation.id,
    ldap_groups_dn="dc=example,dc=org",
    group_name_ldap_attribute="cn",
    group_object_classes=["groupOfNames"],
    membership_attribute_type="DN",
    membership_ldap_attribute="member",
    membership_user_ldap_attribute="cn",
    memberof_ldap_attribute="memberOf")
import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const ldapUserFederation = new keycloak.ldap.UserFederation("ldapUserFederation", {
    realmId: realm.id,
    usernameLdapAttribute: "cn",
    rdnLdapAttribute: "cn",
    uuidLdapAttribute: "entryDN",
    userObjectClasses: [
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connectionUrl: "ldap://openldap",
    usersDn: "dc=example,dc=org",
    bindDn: "cn=admin,dc=example,dc=org",
    bindCredential: "admin",
});
const ldapGroupMapper = new keycloak.ldap.GroupMapper("ldapGroupMapper", {
    realmId: realm.id,
    ldapUserFederationId: ldapUserFederation.id,
    ldapGroupsDn: "dc=example,dc=org",
    groupNameLdapAttribute: "cn",
    groupObjectClasses: ["groupOfNames"],
    membershipAttributeType: "DN",
    membershipLdapAttribute: "member",
    membershipUserLdapAttribute: "cn",
    memberofLdapAttribute: "memberOf",
});
resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  ldapUserFederation:
    type: keycloak:ldap:UserFederation
    properties:
      realmId: ${realm.id}
      usernameLdapAttribute: cn
      rdnLdapAttribute: cn
      uuidLdapAttribute: entryDN
      userObjectClasses:
        - simpleSecurityObject
        - organizationalRole
      connectionUrl: ldap://openldap
      usersDn: dc=example,dc=org
      bindDn: cn=admin,dc=example,dc=org
      bindCredential: admin
  ldapGroupMapper:
    type: keycloak:ldap:GroupMapper
    properties:
      realmId: ${realm.id}
      ldapUserFederationId: ${ldapUserFederation.id}
      ldapGroupsDn: dc=example,dc=org
      groupNameLdapAttribute: cn
      groupObjectClasses:
        - groupOfNames
      membershipAttributeType: DN
      membershipLdapAttribute: member
      membershipUserLdapAttribute: cn
      memberofLdapAttribute: memberOf

Create GroupMapper Resource

new GroupMapper(name: string, args: GroupMapperArgs, opts?: CustomResourceOptions);
@overload
def GroupMapper(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                drop_non_existing_groups_during_sync: Optional[bool] = None,
                group_name_ldap_attribute: Optional[str] = None,
                group_object_classes: Optional[Sequence[str]] = None,
                groups_ldap_filter: Optional[str] = None,
                groups_path: Optional[str] = None,
                ignore_missing_groups: Optional[bool] = None,
                ldap_groups_dn: Optional[str] = None,
                ldap_user_federation_id: Optional[str] = None,
                mapped_group_attributes: Optional[Sequence[str]] = None,
                memberof_ldap_attribute: Optional[str] = None,
                membership_attribute_type: Optional[str] = None,
                membership_ldap_attribute: Optional[str] = None,
                membership_user_ldap_attribute: Optional[str] = None,
                mode: Optional[str] = None,
                name: Optional[str] = None,
                preserve_group_inheritance: Optional[bool] = None,
                realm_id: Optional[str] = None,
                user_roles_retrieve_strategy: Optional[str] = None)
@overload
def GroupMapper(resource_name: str,
                args: GroupMapperArgs,
                opts: Optional[ResourceOptions] = None)
func NewGroupMapper(ctx *Context, name string, args GroupMapperArgs, opts ...ResourceOption) (*GroupMapper, error)
public GroupMapper(string name, GroupMapperArgs args, CustomResourceOptions? opts = null)
public GroupMapper(String name, GroupMapperArgs args)
public GroupMapper(String name, GroupMapperArgs args, CustomResourceOptions options)
type: keycloak:ldap:GroupMapper
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string
The unique name of the resource.
args GroupMapperArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args GroupMapperArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args GroupMapperArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args GroupMapperArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args GroupMapperArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

GroupMapper Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The GroupMapper resource accepts the following input properties:

GroupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

GroupObjectClasses List<string>

List of strings representing the object classes for the group. Must contain at least one.

LdapGroupsDn string

The LDAP DN where groups can be found.

LdapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

MembershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

MembershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

RealmId string

The realm that this LDAP mapper will exist in.

DropNonExistingGroupsDuringSync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

GroupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

GroupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

IgnoreMissingGroups bool

When true, missing groups in the hierarchy will be ignored.

MappedGroupAttributes List<string>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

MemberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

MembershipAttributeType string

Can be one of DN or UID. Defaults to DN.

Mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

Name string

Display name of this mapper when displayed in the console.

PreserveGroupInheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

UserRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

GroupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

GroupObjectClasses []string

List of strings representing the object classes for the group. Must contain at least one.

LdapGroupsDn string

The LDAP DN where groups can be found.

LdapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

MembershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

MembershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

RealmId string

The realm that this LDAP mapper will exist in.

DropNonExistingGroupsDuringSync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

GroupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

GroupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

IgnoreMissingGroups bool

When true, missing groups in the hierarchy will be ignored.

MappedGroupAttributes []string

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

MemberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

MembershipAttributeType string

Can be one of DN or UID. Defaults to DN.

Mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

Name string

Display name of this mapper when displayed in the console.

PreserveGroupInheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

UserRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

groupNameLdapAttribute String

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses List<String>

List of strings representing the object classes for the group. Must contain at least one.

ldapGroupsDn String

The LDAP DN where groups can be found.

ldapUserFederationId String

The ID of the LDAP user federation provider to attach this mapper to.

membershipLdapAttribute String

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute String

The name of the LDAP attribute on a user that is used for membership mappings.

realmId String

The realm that this LDAP mapper will exist in.

dropNonExistingGroupsDuringSync Boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupsLdapFilter String

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath String

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups Boolean

When true, missing groups in the hierarchy will be ignored.

mappedGroupAttributes List<String>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute String

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType String

Can be one of DN or UID. Defaults to DN.

mode String

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name String

Display name of this mapper when displayed in the console.

preserveGroupInheritance Boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

userRolesRetrieveStrategy String

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

groupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses string[]

List of strings representing the object classes for the group. Must contain at least one.

ldapGroupsDn string

The LDAP DN where groups can be found.

ldapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

membershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

realmId string

The realm that this LDAP mapper will exist in.

dropNonExistingGroupsDuringSync boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups boolean

When true, missing groups in the hierarchy will be ignored.

mappedGroupAttributes string[]

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType string

Can be one of DN or UID. Defaults to DN.

mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name string

Display name of this mapper when displayed in the console.

preserveGroupInheritance boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

userRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

group_name_ldap_attribute str

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

group_object_classes Sequence[str]

List of strings representing the object classes for the group. Must contain at least one.

ldap_groups_dn str

The LDAP DN where groups can be found.

ldap_user_federation_id str

The ID of the LDAP user federation provider to attach this mapper to.

membership_ldap_attribute str

The name of the LDAP attribute that is used for membership mappings.

membership_user_ldap_attribute str

The name of the LDAP attribute on a user that is used for membership mappings.

realm_id str

The realm that this LDAP mapper will exist in.

drop_non_existing_groups_during_sync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groups_ldap_filter str

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groups_path str

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignore_missing_groups bool

When true, missing groups in the hierarchy will be ignored.

mapped_group_attributes Sequence[str]

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberof_ldap_attribute str

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membership_attribute_type str

Can be one of DN or UID. Defaults to DN.

mode str

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name str

Display name of this mapper when displayed in the console.

preserve_group_inheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

user_roles_retrieve_strategy str

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

groupNameLdapAttribute String

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses List<String>

List of strings representing the object classes for the group. Must contain at least one.

ldapGroupsDn String

The LDAP DN where groups can be found.

ldapUserFederationId String

The ID of the LDAP user federation provider to attach this mapper to.

membershipLdapAttribute String

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute String

The name of the LDAP attribute on a user that is used for membership mappings.

realmId String

The realm that this LDAP mapper will exist in.

dropNonExistingGroupsDuringSync Boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupsLdapFilter String

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath String

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups Boolean

When true, missing groups in the hierarchy will be ignored.

mappedGroupAttributes List<String>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute String

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType String

Can be one of DN or UID. Defaults to DN.

mode String

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name String

Display name of this mapper when displayed in the console.

preserveGroupInheritance Boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

userRolesRetrieveStrategy String

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

Outputs

All input properties are implicitly available as output properties. Additionally, the GroupMapper resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id string

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

Look up Existing GroupMapper Resource

Get an existing GroupMapper resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: GroupMapperState, opts?: CustomResourceOptions): GroupMapper
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        drop_non_existing_groups_during_sync: Optional[bool] = None,
        group_name_ldap_attribute: Optional[str] = None,
        group_object_classes: Optional[Sequence[str]] = None,
        groups_ldap_filter: Optional[str] = None,
        groups_path: Optional[str] = None,
        ignore_missing_groups: Optional[bool] = None,
        ldap_groups_dn: Optional[str] = None,
        ldap_user_federation_id: Optional[str] = None,
        mapped_group_attributes: Optional[Sequence[str]] = None,
        memberof_ldap_attribute: Optional[str] = None,
        membership_attribute_type: Optional[str] = None,
        membership_ldap_attribute: Optional[str] = None,
        membership_user_ldap_attribute: Optional[str] = None,
        mode: Optional[str] = None,
        name: Optional[str] = None,
        preserve_group_inheritance: Optional[bool] = None,
        realm_id: Optional[str] = None,
        user_roles_retrieve_strategy: Optional[str] = None) -> GroupMapper
func GetGroupMapper(ctx *Context, name string, id IDInput, state *GroupMapperState, opts ...ResourceOption) (*GroupMapper, error)
public static GroupMapper Get(string name, Input<string> id, GroupMapperState? state, CustomResourceOptions? opts = null)
public static GroupMapper get(String name, Output<String> id, GroupMapperState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
DropNonExistingGroupsDuringSync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

GroupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

GroupObjectClasses List<string>

List of strings representing the object classes for the group. Must contain at least one.

GroupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

GroupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

IgnoreMissingGroups bool

When true, missing groups in the hierarchy will be ignored.

LdapGroupsDn string

The LDAP DN where groups can be found.

LdapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

MappedGroupAttributes List<string>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

MemberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

MembershipAttributeType string

Can be one of DN or UID. Defaults to DN.

MembershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

MembershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

Mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

Name string

Display name of this mapper when displayed in the console.

PreserveGroupInheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

RealmId string

The realm that this LDAP mapper will exist in.

UserRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

DropNonExistingGroupsDuringSync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

GroupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

GroupObjectClasses []string

List of strings representing the object classes for the group. Must contain at least one.

GroupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

GroupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

IgnoreMissingGroups bool

When true, missing groups in the hierarchy will be ignored.

LdapGroupsDn string

The LDAP DN where groups can be found.

LdapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

MappedGroupAttributes []string

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

MemberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

MembershipAttributeType string

Can be one of DN or UID. Defaults to DN.

MembershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

MembershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

Mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

Name string

Display name of this mapper when displayed in the console.

PreserveGroupInheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

RealmId string

The realm that this LDAP mapper will exist in.

UserRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

dropNonExistingGroupsDuringSync Boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupNameLdapAttribute String

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses List<String>

List of strings representing the object classes for the group. Must contain at least one.

groupsLdapFilter String

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath String

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups Boolean

When true, missing groups in the hierarchy will be ignored.

ldapGroupsDn String

The LDAP DN where groups can be found.

ldapUserFederationId String

The ID of the LDAP user federation provider to attach this mapper to.

mappedGroupAttributes List<String>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute String

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType String

Can be one of DN or UID. Defaults to DN.

membershipLdapAttribute String

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute String

The name of the LDAP attribute on a user that is used for membership mappings.

mode String

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name String

Display name of this mapper when displayed in the console.

preserveGroupInheritance Boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

realmId String

The realm that this LDAP mapper will exist in.

userRolesRetrieveStrategy String

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

dropNonExistingGroupsDuringSync boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupNameLdapAttribute string

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses string[]

List of strings representing the object classes for the group. Must contain at least one.

groupsLdapFilter string

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath string

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups boolean

When true, missing groups in the hierarchy will be ignored.

ldapGroupsDn string

The LDAP DN where groups can be found.

ldapUserFederationId string

The ID of the LDAP user federation provider to attach this mapper to.

mappedGroupAttributes string[]

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute string

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType string

Can be one of DN or UID. Defaults to DN.

membershipLdapAttribute string

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute string

The name of the LDAP attribute on a user that is used for membership mappings.

mode string

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name string

Display name of this mapper when displayed in the console.

preserveGroupInheritance boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

realmId string

The realm that this LDAP mapper will exist in.

userRolesRetrieveStrategy string

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

drop_non_existing_groups_during_sync bool

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

group_name_ldap_attribute str

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

group_object_classes Sequence[str]

List of strings representing the object classes for the group. Must contain at least one.

groups_ldap_filter str

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groups_path str

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignore_missing_groups bool

When true, missing groups in the hierarchy will be ignored.

ldap_groups_dn str

The LDAP DN where groups can be found.

ldap_user_federation_id str

The ID of the LDAP user federation provider to attach this mapper to.

mapped_group_attributes Sequence[str]

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberof_ldap_attribute str

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membership_attribute_type str

Can be one of DN or UID. Defaults to DN.

membership_ldap_attribute str

The name of the LDAP attribute that is used for membership mappings.

membership_user_ldap_attribute str

The name of the LDAP attribute on a user that is used for membership mappings.

mode str

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name str

Display name of this mapper when displayed in the console.

preserve_group_inheritance bool

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

realm_id str

The realm that this LDAP mapper will exist in.

user_roles_retrieve_strategy str

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

dropNonExistingGroupsDuringSync Boolean

When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

groupNameLdapAttribute String

The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.

groupObjectClasses List<String>

List of strings representing the object classes for the group. Must contain at least one.

groupsLdapFilter String

When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).

groupsPath String

Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.

ignoreMissingGroups Boolean

When true, missing groups in the hierarchy will be ignored.

ldapGroupsDn String

The LDAP DN where groups can be found.

ldapUserFederationId String

The ID of the LDAP user federation provider to attach this mapper to.

mappedGroupAttributes List<String>

Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.

memberofLdapAttribute String

Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.

membershipAttributeType String

Can be one of DN or UID. Defaults to DN.

membershipLdapAttribute String

The name of the LDAP attribute that is used for membership mappings.

membershipUserLdapAttribute String

The name of the LDAP attribute on a user that is used for membership mappings.

mode String

Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.

name String

Display name of this mapper when displayed in the console.

preserveGroupInheritance Boolean

When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.

realmId String

The realm that this LDAP mapper will exist in.

userRolesRetrieveStrategy String

Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.

Import

LDAP mappers can be imported using the format {{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}. The ID of the LDAP user federation provider and the mapper can be found within the Keycloak GUI, and they are typically GUIDs. Examplebash

 $ pulumi import keycloak:ldap/groupMapper:GroupMapper ldap_group_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67

Package Details

Repository
https://github.com/pulumi/pulumi-keycloak
License
Apache-2.0
Notes

This Pulumi package is based on the keycloak Terraform Provider.