Replies: 1 comment 5 replies
-
|
Before answering, let me state a few general considerations for IDs. The answer would then follow.
Since the human-readable DN with clientId does not satisfy the Item 3, I don't think it could be treated as ID. However it seems that it would be possible still to use human readable DN as long as the ID was the GUID. Does it sound viable to you? |
Beta Was this translation helpful? Give feedback.
-
|
On top of that - for client roles specifically - if a client ID is obtained from external storage, then it should be put into an attribute of that LDAP role object in unchanged string form, perhaps |
Beta Was this translation helpful? Give feedback.
-
|
Thanks, this confirms that a ID of the store that is storing the clients must be used, as it must not change over time. I was kind of expecting this, but hoping for something different. And that would be a UUID most of the time AFAIK. I wonder who decided to make the clientId changeable, I don't understand that use case yet. For my test implementation I was using the EntryUUID to reference LDAP entities, and it would be a GUID for ActiveDirectory. My current tests show that I still need a searchDN to look up an object via that id, what is surprising to me. Let's see. Regarding ou vs cn: I'm an LDAP beginner, yes CN would probably be it. To me this is now answered. Will move it to answered stuff soon if there is no other comment. |
Beta Was this translation helpful? Give feedback.
-
|
Another comment on on vs cn: For a client role, the full DN would be cn=name_of_role,ou=id_of_client,dc=keycloak,dc=org. So ithe client ID would go into "ou" and the name of the role in the "cn". Please let me know what you think. |
Beta Was this translation helpful? Give feedback.
-
|
The RDN |
Beta Was this translation helpful? Give feedback.
-
|
An example: cn=myclientrole,ou=e44b2d1c-9b00-4f22-a8c1-d0aa1c48d7fb,dc=keycloak,dc=org where "myclientrole" is returned by role.getName(), and "e44b2d1c-9b00-4f22-a8c1-d0aa1c48d7fb" is returned by role.getClientId() (what is the same value as in client.getId()) |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Problem statement
When retrieving client roles from a store, the query contains the client ID that is a UUID.
There is also the clientID (like "account" or "account-console"), but that is not available to create for example a LDAP DN.
The UUID is not very human friendly. The good thing: the ID doesn't change even when the clientId changes.
DN with UUID: ou=e44b2d1c-9b00-4f22-a8c1-d0aa1c48d7fb,dc=keycloak,dc=org
DN with clientID: ou=account,dc=keycloak,dc=org
Approach
Could the LDAP store use the client ID UUID to look up a client to retrieve additional information to then query
Benefits
API of map storage can stay the same.
Alternatives
Beta Was this translation helpful? Give feedback.
All reactions