Keycloak能否从文件加载LDAP配置？容器版7.0.0自动加载方法咨询

1. Can Keycloak load LDAP configuration from a file? #

Absolutely! Keycloak supports loading LDAP user federation configuration via files—this is actually a common approach to automate setup instead of relying on manual UI entry. You can use realm export/import JSON files, modified standalone server configuration XML, or CLI scripts to define your LDAP settings externally and load them at startup.

2. Automating LDAP User Federation Setup for Containerized Keycloak 7.0.0 (Standalone Mode) #

Since you're running the 7.0.0 containerized version (based on WildFly, not the newer Quarkus distribution), here are three reliable methods to auto-load your LDAP config on startup:

Method 1: Realm Export/Import (Simplest for Most Cases) #

This approach lets you configure LDAP once via the UI, export the config, then import it automatically when the container starts:

• Step 1: Export the configured LDAP setup
  1. Spin up a local instance of Keycloak 7.0.0 (matching your container version).
  2. Log into the admin console, create your target realm (if it doesn’t exist), and set up your LDAP user federation provider with all your desired settings.
  3. Export the realm configuration to a JSON file. For a local instance, run:

     ./bin/standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.realmName=YOUR_REALM_NAME -Dkeycloak.migration.file=./ldap-realm-config.json
     

     Or do this inside a temporary container:

     docker run --rm -v $(pwd):/tmp jboss/keycloak:7.0.0 /opt/jboss/keycloak/bin/standalone.sh -Dkeycloak.migration.action=export -Dkeycloak.migration.realmName=YOUR_REALM_NAME -Dkeycloak.migration.file=/tmp/ldap-realm-config.json
     

• Step 2: Import the config on container startup
  Mount the exported JSON file into your container and tell Keycloak to import it on launch:

  docker run -v $(pwd)/ldap-realm-config.json:/opt/jboss/keycloak/imports/ldap-realm-config.json jboss/keycloak:7.0.0 -Dkeycloak.import=/opt/jboss/keycloak/imports/ldap-realm-config.json
  

  This will automatically load your LDAP user federation settings into the specified realm on startup.

Method 2: Modify the Standalone XML Configuration #

Keycloak stores core server config in standalone.xml for standalone mode. You can pre-configure your LDAP provider directly in this file and mount it into the container:

• Step 1: Get the base standalone.xml
  Copy the default config from a running Keycloak 7.0.0 container:

  docker run --rm jboss/keycloak:7.0.0 cat /opt/jboss/keycloak/standalone/configuration/standalone.xml > ./standalone-custom.xml
  

• Step 2: Add LDAP provider config
  Open standalone-custom.xml, find the <userFederationProviders> section under your realm’s configuration, and add an LDAP provider block (adjust values to match your LDAP server):

  <userFederationProviders>
    <provider>
      <name>LDAP Provider</name>
      <providerId>ldap</providerId>
      <enabled>true</enabled>
      <config>
        <property name="fullSyncPeriod" value="-1"/>
        <property name="changedSyncPeriod" value="-1"/>
        <property name="cachePolicy" value="DEFAULT"/>
        <property name="ldapUrl" value="ldap://your-ldap-server:389"/>
        <property name="bindDn" value="cn=admin,dc=example,dc=com"/>
        <property name="bindCredential" value="your-ldap-password"/>
        <property name="usersDn" value="ou=users,dc=example,dc=com"/>
        <property name="usernameLDAPAttribute" value="uid"/>
        <property name="rdnLDAPAttribute" value="uid"/>
        <property name="uuidLDAPAttribute" value="entryUUID"/>
        <property name="userObjectClasses" value="inetOrgPerson, organizationalPerson"/>
        <property name="connectionPooling" value="true"/>
        <property name="pagination" value="true"/>
      </config>
    </provider>
  </userFederationProviders>
  

• Step 3: Mount the modified XML into the container
  Start the container with your custom config:

  docker run -v $(pwd)/standalone-custom.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml jboss/keycloak:7.0.0
  

Method 3: Use a WildFly CLI Script #

You can write a CLI script that adds the LDAP provider, then execute it during container startup:

• Step 1: Create the CLI script (configure-ldap.cli)

  embed-server --server-config=standalone.xml --std-out=echo
  /subsystem=keycloak-server/realm=YOUR_REALM_NAME/user-federation-provider=ldap:add(name="LDAP Provider",provider-id="ldap",enabled=true,config=[
      ("fullSyncPeriod", "-1"),
      ("changedSyncPeriod", "-1"),
      ("ldapUrl", "ldap://your-ldap-server:389"),
      ("bindDn", "cn=admin,dc=example,dc=com"),
      ("bindCredential", "your-ldap-password"),
      ("usersDn", "ou=users,dc=example,dc=com"),
      ("usernameLDAPAttribute", "uid"),
      ("rdnLDAPAttribute", "uid"),
      ("uuidLDAPAttribute", "entryUUID"),
      ("userObjectClasses", "inetOrgPerson, organizationalPerson")
  ])
  stop-embedded-server
  

• Step 2: Run the script on container startup
  Mount the script and pass it to Keycloak’s startup command:

  docker run -v $(pwd)/configure-ldap.cli:/opt/jboss/keycloak/configure-ldap.cli jboss/keycloak:7.0.0 /opt/jboss/keycloak/bin/standalone.sh -c standalone.xml -b 0.0.0.0 --cli-script=/opt/jboss/keycloak/configure-ldap.cli
  

Quick Notes #

• Double-check all LDAP server details (URL, bind DN, password) match your environment.
• For production, avoid plaintext passwords in config files—use Keycloak’s credential store or environment variable substitution (you can use $(env.VAR_NAME) in CLI scripts/XML to pull values from container env vars).
• Since 7.0.0 is an older WildFly-based release, newer Quarkus-specific commands won’t work here—stick to the methods above.

内容的提问来源于stack exchange，提问作者Ben R