Push ldap-Groups over Group-Mapping from Keycloak to xWiki

Remember: Groups are created once a user logs on. There is no real sync. But with every login the ldap membership is reflected to XWiki over the keycloak login-token. In XWiki you can assign rights to the pushed ldap-Keycloak-xWiki-groups.

Follow these steps:

• Open Keycloak admin console with https://KEYCLOAK_ADDRESS/auth/admin/ and login with admin credentials.
• First of all you need an ldap provider which gets the users and groups from ldap.
• Click on User Federation in the left panel
• When a ldap provider is not existent go to add provider. 1) (no documentation for this step)

• After creating the ldap provider click on ldap 2)

  

   Keycloak Admin Interface - Overview of the user federation provider list

   

• Click on mappers 1) an look for a groups mapper 2). If it is missing click on create 3)

  

   Keycloak Admin Interface - List of Mappers of an Keycloak user federation provider. Here: ldap

   

• Choose the mapper-type 1) "group-ldap-mapper" and fill in the information from your ldap-configuration

  

   Keycloak Admin Interface - Adding a user federation mapper. Here: groups-mapper.

   

• Afterwards click on save an move on to Client Scopes 1) in the left Panel. Look for a group scope 2) If it does not exist create one 3)

  

   Keycloak Admin Interface - List of global available client scopes

    

• Chose the following configuration for the groups scope. Click on save.

  

   Keycloak Admin Interface - Adding a group scope in Keycloak. Here: Part one, the name an protocol.  

   

• Move on to the Mappers-tab 1) and creat a built in mapper 2). aim is to have a groups mapper 3)

  

    Keycloak Admin Interface - Adding a group scope in Keycloak. Here: Part two, the list of mappers. 

   

• Chose the mapper 1) from the list an click on save. (Save button at the end of the list and not in the picture.)

  

   Keycloak Admin Interface - Adding a group scope in Keycloak. Here: Part tgree, the built in mappers to chose and add.  

   

• Go to Clients 1) and chose your xWiki Client ID 2) which you created while adding keycloak as authentication provider. Chos the tab Client Scopes (Number Missing) and add the new groups scope 3) to the Assigned Default Client Scope 5) with button 4)

  

   Keycloak Admin Interface - Enabling the new created group scope for the XWiki client.

   

• Test it by Clicking on Evaluate 3), chose the user 4), click evaluate 5) and move to the tab Generated Access Token 6. Groups should be listed in the client scopes 7) and the list of groups should be visible, too 8)

  

   Keycloak Admin Interface - Evaluate the new assigned group scope and test, if groups are sent with the token.

• Done. If I remember correctly the steps.