{"type":"doc","content":[{"type":"heading","attrs":{"level":2},"content":[{"text":"Create a custom scope","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Keycloak administration console","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Client scopes” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Create client scope”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the following information:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name: modelop_client","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Description: A ModelOp custom scope used to distinguish between an OAuth2 client and an end-user","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Type: Optional","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Protocol: OpenID Connect","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Display on consent screen: Off","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Include in token scope: On","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Display Order: ","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Save”","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once the scope is created, add it as a scope to the internal-client by following these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Clients” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select “internal-client”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Client scopes” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Add client scope”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select “modelop_client”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Add” and select “Optional”","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create a user attribute mapper","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please use this type of mapper when there is an LDAP attribute containing the user’s group(s)","type":"text"}]}]},{"type":"paragraph","content":[{"text":"To create a user attribute","type":"text"},{"text":" ","type":"text","marks":[{"type":"strong"}]},{"text":"mapper which specifies which LDAP attribute maps to the attribute of the Keycloak user, please follow these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Keycloak administration console","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “User Federation” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the LDAP provider","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Mappers” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Add mapper”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the following information:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name: modelOpGroups","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mapper Type: user-attribute-ldap-mapper","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAP Groups DN","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User Model Attribute: memberOf","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAP Attribute: ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Read Only: On","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Always Read Value From LDAP: On","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Is Mandatory in LDAP: Off","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Attribute default value: ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Force a Default Value: Off","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Is Binary Attribute: Off","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Save”","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once the group mapper is defined, it needs to be applied to all users by following these steps, starting with “Step 4. Open the ‘Mappers’ tab” listed above:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the upper right corner, select “Sync all users” from the dropdown menu for “Action”.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create a hardcoded attribute mapper","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please use this type of mapper when there is ","type":"text"},{"text":"no LDAP attribute","type":"text","marks":[{"type":"strong"}]},{"text":" containing the user’s group(s)","type":"text"}]}]},{"type":"paragraph","content":[{"text":"To create a hardcoded attribute mapper which adds a hardcoded group value to each Keycloak user linked with LDAP, please follow these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Keycloak administration console","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “User Federation” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the LDAP provider","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Mappers” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Add mapper”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the following information:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name: modelOpGroups","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mapper Type: hardcoded-attribute-mapper","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"User Model Attribute Name: memberOf","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Attribute Value: modelop","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Save”","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Once the group mapper is defined, it needs to be applied to all users by following these steps, starting with “Step 4. Open the ‘Mappers’ tab” listed above:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In the upper right corner, select “Sync all users” from the dropdown menu for “Action”.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Create a group mapper","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Please use this type of mapper when there is a branch of an LDAP tree containing the user’s group(s)","type":"text"}]}]},{"type":"paragraph","content":[{"text":"To create a group mapper which maps LDAP groups from a branch of an LDAP tree into groups within Keycloak, please follow these steps:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Keycloak administration console","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “User Federation” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the LDAP provider","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the “Mappers” tab","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click “Add mapper”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the following information:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Name: modelOpGroups","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Mapper type: group-ldap-mapper","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAP Groups DN: ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Group Name LDAP Attribute: ","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Group Object Classes:

Browser not supported