Keycloak Group-Mapping to xWiki

Version 8.1 by Johannes Wielsch on 2020/09/02 20:32

So lets start and have some fun with ldap an keycloak group mapping.

Aim is: Map LDAP Groups with Keycloak and push them to xWiki.

Remember: Groups are created once a user logs on. There is no real sync. But with every login the ldap membership is reflected to XWiki over the keycloak login-token. In XWiki you can assign rights to the pushed ldap-Keycloak-xWiki-groups.

Follow these steps:

  • Open Keycloak admin console with https://KEYCLOAK_ADDRESS/auth/admin/ and login with admin credentials.
  • First of all you need an ldap provider which gets the users and groups from ldap.
  • Click on User Federation in the left panel
  • When a ldap provider is not existent go to add provider. 1) - Aim is to have an ldap provider like the one listed here 2)
  • After creating the ldap provider click on ldap 2) (no documentation for this step)

2020-09-02 19_48_04-Einstellungen.png

  • Click on mappers 1) an look for a groups mapper 2). If it is missing click on create 3)

2020-09-02 19_48_53-Einstellungen.png

  • Choose the mapper-type 1) "group-ldap-mapper" and fill in the information from your ldap-configuration

2020-09-02 19_52_52-Einstellungen.png

  • Afterwards click on save an move on to Client Scopes 1) in the left Panel. Look for a group scope 2) If it does not exist create one 3)

2020-09-02 19_53_30-Einstellungen.png

  • Chose the following configuration for the groups scope. Click on save.

2020-09-02 19_54_21-Einstellungen.png

  • Move on to the Mappers-tab 1) and creat a built in mapper 2). aim is to have a groups mapper 3)

2020-09-02 19_55_25-Einstellungen.png

  • Chose the mapper 1) from the list an click on save. (Save button at the end of the list and not in the picture.)

2020-09-02 19_56_08-Keycloak Admin Konsole und 2 weitere Seiten - Persönlich – Microsoft​ Edge.png

  • Go to Clients 1) and chose your xWiki Client ID 2) which you created while adding keycloak as authentication provider. Chos the tab Client Scopes (Number Missing) and add the new groups scope 3) to the Assigned Default Client Scope 5) with button 4) 

2020-09-02 20_21_32-Clipboard.png

  • Test it by Clicking on Evaluate 3), chose the user 4), click evaluate 5) and move to the tab Generated Access Token 6. Groups should be listed in the client scopes 7) and the list of groups should be visible, too 8) 

2020-09-02 19_58_36-Einstellungen.png

  • Done. If I remember correctly the steps. 

 

Tags:
    

Get Connected