pulumi-keycloak-kotlin/com.pulumi.keycloak.ldap.kotlin/GroupMapperArgs

GroupMapperArgs

data class GroupMapperArgs(val dropNonExistingGroupsDuringSync: Output<Boolean>? = null, val groupNameLdapAttribute: Output<String>? = null, val groupObjectClasses: Output<List<String>>? = null, val groupsLdapFilter: Output<String>? = null, val groupsPath: Output<String>? = null, val ignoreMissingGroups: Output<Boolean>? = null, val ldapGroupsDn: Output<String>? = null, val ldapUserFederationId: Output<String>? = null, val mappedGroupAttributes: Output<List<String>>? = null, val memberofLdapAttribute: Output<String>? = null, val membershipAttributeType: Output<String>? = null, val membershipLdapAttribute: Output<String>? = null, val membershipUserLdapAttribute: Output<String>? = null, val mode: Output<String>? = null, val name: Output<String>? = null, val preserveGroupInheritance: Output<Boolean>? = null, val realmId: Output<String>? = null, val userRolesRetrieveStrategy: Output<String>? = null) : ConvertibleToJava<GroupMapperArgs>

# keycloak.ldap.GroupMapper

Allows for creating and managing group mappers for Keycloak users federated via LDAP. The LDAP group mapper can be used to map an LDAP user's groups from some DN to Keycloak groups. This group mapper will also create the groups within Keycloak if they do not already exist.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";
const realm = new keycloak.Realm("realm", {
    realm: "test",
    enabled: true,
});
const ldapUserFederation = new keycloak.ldap.UserFederation("ldap_user_federation", {
    name: "openldap",
    realmId: realm.id,
    usernameLdapAttribute: "cn",
    rdnLdapAttribute: "cn",
    uuidLdapAttribute: "entryDN",
    userObjectClasses: [
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connectionUrl: "ldap://openldap",
    usersDn: "dc=example,dc=org",
    bindDn: "cn=admin,dc=example,dc=org",
    bindCredential: "admin",
});
const ldapGroupMapper = new keycloak.ldap.GroupMapper("ldap_group_mapper", {
    realmId: realm.id,
    ldapUserFederationId: ldapUserFederation.id,
    name: "group-mapper",
    ldapGroupsDn: "dc=example,dc=org",
    groupNameLdapAttribute: "cn",
    groupObjectClasses: ["groupOfNames"],
    membershipAttributeType: "DN",
    membershipLdapAttribute: "member",
    membershipUserLdapAttribute: "cn",
    memberofLdapAttribute: "memberOf",
});

import pulumi
import pulumi_keycloak as keycloak
realm = keycloak.Realm("realm",
    realm="test",
    enabled=True)
ldap_user_federation = keycloak.ldap.UserFederation("ldap_user_federation",
    name="openldap",
    realm_id=realm.id,
    username_ldap_attribute="cn",
    rdn_ldap_attribute="cn",
    uuid_ldap_attribute="entryDN",
    user_object_classes=[
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connection_url="ldap://openldap",
    users_dn="dc=example,dc=org",
    bind_dn="cn=admin,dc=example,dc=org",
    bind_credential="admin")
ldap_group_mapper = keycloak.ldap.GroupMapper("ldap_group_mapper",
    realm_id=realm.id,
    ldap_user_federation_id=ldap_user_federation.id,
    name="group-mapper",
    ldap_groups_dn="dc=example,dc=org",
    group_name_ldap_attribute="cn",
    group_object_classes=["groupOfNames"],
    membership_attribute_type="DN",
    membership_ldap_attribute="member",
    membership_user_ldap_attribute="cn",
    memberof_ldap_attribute="memberOf")

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;
return await Deployment.RunAsync(() =>
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "test",
        Enabled = true,
    });
    var ldapUserFederation = new Keycloak.Ldap.UserFederation("ldap_user_federation", new()
    {
        Name = "openldap",
        RealmId = realm.Id,
        UsernameLdapAttribute = "cn",
        RdnLdapAttribute = "cn",
        UuidLdapAttribute = "entryDN",
        UserObjectClasses = new[]
        {
            "simpleSecurityObject",
            "organizationalRole",
        },
        ConnectionUrl = "ldap://openldap",
        UsersDn = "dc=example,dc=org",
        BindDn = "cn=admin,dc=example,dc=org",
        BindCredential = "admin",
    });
    var ldapGroupMapper = new Keycloak.Ldap.GroupMapper("ldap_group_mapper", new()
    {
        RealmId = realm.Id,
        LdapUserFederationId = ldapUserFederation.Id,
        Name = "group-mapper",
        LdapGroupsDn = "dc=example,dc=org",
        GroupNameLdapAttribute = "cn",
        GroupObjectClasses = new[]
        {
            "groupOfNames",
        },
        MembershipAttributeType = "DN",
        MembershipLdapAttribute = "member",
        MembershipUserLdapAttribute = "cn",
        MemberofLdapAttribute = "memberOf",
    });
});

package main
import (
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak/ldap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("test"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		ldapUserFederation, err := ldap.NewUserFederation(ctx, "ldap_user_federation", &ldap.UserFederationArgs{
			Name:                  pulumi.String("openldap"),
			RealmId:               realm.ID(),
			UsernameLdapAttribute: pulumi.String("cn"),
			RdnLdapAttribute:      pulumi.String("cn"),
			UuidLdapAttribute:     pulumi.String("entryDN"),
			UserObjectClasses: pulumi.StringArray{
				pulumi.String("simpleSecurityObject"),
				pulumi.String("organizationalRole"),
			},
			ConnectionUrl:  pulumi.String("ldap://openldap"),
			UsersDn:        pulumi.String("dc=example,dc=org"),
			BindDn:         pulumi.String("cn=admin,dc=example,dc=org"),
			BindCredential: pulumi.String("admin"),
		})
		if err != nil {
			return err
		}
		_, err = ldap.NewGroupMapper(ctx, "ldap_group_mapper", &ldap.GroupMapperArgs{
			RealmId:                realm.ID(),
			LdapUserFederationId:   ldapUserFederation.ID(),
			Name:                   pulumi.String("group-mapper"),
			LdapGroupsDn:           pulumi.String("dc=example,dc=org"),
			GroupNameLdapAttribute: pulumi.String("cn"),
			GroupObjectClasses: pulumi.StringArray{
				pulumi.String("groupOfNames"),
			},
			MembershipAttributeType:     pulumi.String("DN"),
			MembershipLdapAttribute:     pulumi.String("member"),
			MembershipUserLdapAttribute: pulumi.String("cn"),
			MemberofLdapAttribute:       pulumi.String("memberOf"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.ldap.UserFederation;
import com.pulumi.keycloak.ldap.UserFederationArgs;
import com.pulumi.keycloak.ldap.GroupMapper;
import com.pulumi.keycloak.ldap.GroupMapperArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("test")
            .enabled(true)
            .build());
        var ldapUserFederation = new UserFederation("ldapUserFederation", UserFederationArgs.builder()
            .name("openldap")
            .realmId(realm.id())
            .usernameLdapAttribute("cn")
            .rdnLdapAttribute("cn")
            .uuidLdapAttribute("entryDN")
            .userObjectClasses(
                "simpleSecurityObject",
                "organizationalRole")
            .connectionUrl("ldap://openldap")
            .usersDn("dc=example,dc=org")
            .bindDn("cn=admin,dc=example,dc=org")
            .bindCredential("admin")
            .build());
        var ldapGroupMapper = new GroupMapper("ldapGroupMapper", GroupMapperArgs.builder()
            .realmId(realm.id())
            .ldapUserFederationId(ldapUserFederation.id())
            .name("group-mapper")
            .ldapGroupsDn("dc=example,dc=org")
            .groupNameLdapAttribute("cn")
            .groupObjectClasses("groupOfNames")
            .membershipAttributeType("DN")
            .membershipLdapAttribute("member")
            .membershipUserLdapAttribute("cn")
            .memberofLdapAttribute("memberOf")
            .build());
    }
}

resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: test
      enabled: true
  ldapUserFederation:
    type: keycloak:ldap:UserFederation
    name: ldap_user_federation
    properties:
      name: openldap
      realmId: ${realm.id}
      usernameLdapAttribute: cn
      rdnLdapAttribute: cn
      uuidLdapAttribute: entryDN
      userObjectClasses:
        - simpleSecurityObject
        - organizationalRole
      connectionUrl: ldap://openldap
      usersDn: dc=example,dc=org
      bindDn: cn=admin,dc=example,dc=org
      bindCredential: admin
  ldapGroupMapper:
    type: keycloak:ldap:GroupMapper
    name: ldap_group_mapper
    properties:
      realmId: ${realm.id}
      ldapUserFederationId: ${ldapUserFederation.id}
      name: group-mapper
      ldapGroupsDn: dc=example,dc=org
      groupNameLdapAttribute: cn
      groupObjectClasses:
        - groupOfNames
      membershipAttributeType: DN
      membershipLdapAttribute: member
      membershipUserLdapAttribute: cn
      memberofLdapAttribute: memberOf

Argument Reference

The following arguments are supported:

realm_id - (Required) The realm that this LDAP mapper will exist in.
ldap_user_federation_id - (Required) The ID of the LDAP user federation provider to attach this mapper to.
name - (Required) Display name of this mapper when displayed in the console.
ldap_groups_dn - (Required) The LDAP DN where groups can be found.
group_name_ldap_attribute - (Required) The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
group_object_classes - (Required) Array of strings representing the object classes for the group. Must contain at least one.
preserve_group_inheritance - (Optional) When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
ignore_missing_groups - (Optional) When true, missing groups in the hierarchy will be ignored.
membership_ldap_attribute - (Required) The name of the LDAP attribute that is used for membership mappings.
membership_attribute_type - (Optional) Can be one of DN or UID. Defaults to DN.
membership_user_ldap_attribute - (Required) The name of the LDAP attribute on a user that is used for membership mappings.
groups_ldap_filter - (Optional) When specified, adds an additional custom filter to be used when querying for groups. Must start with ( and end with ).
mode - (Optional) Can be one of READ_ONLY or LDAP_ONLY. Defaults to READ_ONLY.
user_roles_retrieve_strategy - (Optional) Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
memberof_ldap_attribute - (Optional) Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
mapped_group_attributes - (Optional) Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
drop_non_existing_groups_during_sync - (Optional) When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.

Import

LDAP mappers can be imported using the format {{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}. The ID of the LDAP user federation provider and the mapper can be found within the Keycloak GUI, and they are typically GUIDs:

$ terraform import keycloak_ldap_group_mapper.ldap_group_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67

Constructors

GroupMapperArgs

constructor(dropNonExistingGroupsDuringSync: Output<Boolean>? = null, groupNameLdapAttribute: Output<String>? = null, groupObjectClasses: Output<List<String>>? = null, groupsLdapFilter: Output<String>? = null, groupsPath: Output<String>? = null, ignoreMissingGroups: Output<Boolean>? = null, ldapGroupsDn: Output<String>? = null, ldapUserFederationId: Output<String>? = null, mappedGroupAttributes: Output<List<String>>? = null, memberofLdapAttribute: Output<String>? = null, membershipAttributeType: Output<String>? = null, membershipLdapAttribute: Output<String>? = null, membershipUserLdapAttribute: Output<String>? = null, mode: Output<String>? = null, name: Output<String>? = null, preserveGroupInheritance: Output<Boolean>? = null, realmId: Output<String>? = null, userRolesRetrieveStrategy: Output<String>? = null)