Secured LDAP user federation with keycloak error occurs during configuration settings

Last Updated : Jun 10, 2026 |

Cause

The keycloak uses the default Java 1.8 as truststore instead of the Java 17 truststore.

Solution

Procedure

  1. To obtain LDAP server certificate, do the following:
    1. Export the LDAP server certificate:

      openssl

    2. View the LDAP server certificate:

      echo | openssl s_client -connect ldap.example.com:636 -showcerts

    3. Copy the certificate to a file. For example: ldap-server.crt
  2. Import the LDAP certificate into keycloak truststore:

    keytool -importcert -file ldap-server.crt -alias ldap-server -keystore /path/to/keycloak/conf/cacerts -storepass changeit

  3. To configure LDAP in keycloak, do the following:
    1. Log into keycloak admin console.
    2. Navigate to the required realm.
    3. Click User Federation > Add LDAP provider.
    4. In the Connection URL field, enter one of the following:

      • For IP address, enter ldaps://10.133.98.168:636

      • For FQDN, enter ldaps://aadsldap.gsc.com:636

    5. Click Test Connection
    6. Enter Bind DN and Bind credentials.
    7. Click Test authentication.

      Successfully connected to LDAP is displayed.

    8. Under LDAP searching and updating section, do the following:

      • Enter User DN. For example: OU=uc7_smg,DC=gsc,DC=com.

      • For Username LDAP attribute, enter one of the following:

        • sAMA account name

        • User principal name

        • Email address.

      Note:

      Name of the LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it can be 'uid'. For Active directory it can be 'sAMAccountName' or 'cn'. The attribute should be filled for all LDAP user records you want to import from LDAP to Keycloak.

    9. Enable Periodic full sync.
  4. Click Save.