Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Keycloak Provider
  3. API Docs
  4. ldap
  5. RoleMapper
Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
pulumi/pulumi-keycloak

keycloak.ldap.RoleMapper

Explore with Pulumi AI

keycloak logo
Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
pulumi/pulumi-keycloak

    Allows for creating and managing role mappers for Keycloak users federated via LDAP.

    The LDAP group mapper can be used to map an LDAP user’s roles from some DN to Keycloak roles.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const ldapUserFederation = new keycloak.ldap.UserFederation("ldap_user_federation", {
    name: "openldap",
    realmId: realm.id,
    usernameLdapAttribute: "cn",
    rdnLdapAttribute: "cn",
    uuidLdapAttribute: "entryDN",
    userObjectClasses: [
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connectionUrl: "ldap://openldap",
    usersDn: "dc=example,dc=org",
    bindDn: "cn=admin,dc=example,dc=org",
    bindCredential: "admin",
});
const ldapRoleMapper = new keycloak.ldap.RoleMapper("ldap_role_mapper", {
    realmId: realm.id,
    ldapUserFederationId: ldapUserFederation.id,
    name: "role-mapper",
    ldapRolesDn: "dc=example,dc=org",
    roleNameLdapAttribute: "cn",
    roleObjectClasses: ["groupOfNames"],
    membershipAttributeType: "DN",
    membershipLdapAttribute: "member",
    membershipUserLdapAttribute: "cn",
    userRolesRetrieveStrategy: "GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE",
    memberofLdapAttribute: "memberOf",
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
ldap_user_federation = keycloak.ldap.UserFederation("ldap_user_federation",
    name="openldap",
    realm_id=realm.id,
    username_ldap_attribute="cn",
    rdn_ldap_attribute="cn",
    uuid_ldap_attribute="entryDN",
    user_object_classes=[
        "simpleSecurityObject",
        "organizationalRole",
    ],
    connection_url="ldap://openldap",
    users_dn="dc=example,dc=org",
    bind_dn="cn=admin,dc=example,dc=org",
    bind_credential="admin")
ldap_role_mapper = keycloak.ldap.RoleMapper("ldap_role_mapper",
    realm_id=realm.id,
    ldap_user_federation_id=ldap_user_federation.id,
    name="role-mapper",
    ldap_roles_dn="dc=example,dc=org",
    role_name_ldap_attribute="cn",
    role_object_classes=["groupOfNames"],
    membership_attribute_type="DN",
    membership_ldap_attribute="member",
    membership_user_ldap_attribute="cn",
    user_roles_retrieve_strategy="GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE",
    memberof_ldap_attribute="memberOf")

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/ldap"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		ldapUserFederation, err := ldap.NewUserFederation(ctx, "ldap_user_federation", &ldap.UserFederationArgs{
			Name:                  pulumi.String("openldap"),
			RealmId:               realm.ID(),
			UsernameLdapAttribute: pulumi.String("cn"),
			RdnLdapAttribute:      pulumi.String("cn"),
			UuidLdapAttribute:     pulumi.String("entryDN"),
			UserObjectClasses: pulumi.StringArray{
				pulumi.String("simpleSecurityObject"),
				pulumi.String("organizationalRole"),
			},
			ConnectionUrl:  pulumi.String("ldap://openldap"),
			UsersDn:        pulumi.String("dc=example,dc=org"),
			BindDn:         pulumi.String("cn=admin,dc=example,dc=org"),
			BindCredential: pulumi.String("admin"),
		})
		if err != nil {
			return err
		}
		_, err = ldap.NewRoleMapper(ctx, "ldap_role_mapper", &ldap.RoleMapperArgs{
			RealmId:               realm.ID(),
			LdapUserFederationId:  ldapUserFederation.ID(),
			Name:                  pulumi.String("role-mapper"),
			LdapRolesDn:           pulumi.String("dc=example,dc=org"),
			RoleNameLdapAttribute: pulumi.String("cn"),
			RoleObjectClasses: pulumi.StringArray{
				pulumi.String("groupOfNames"),
			},
			MembershipAttributeType:     pulumi.String("DN"),
			MembershipLdapAttribute:     pulumi.String("member"),
			MembershipUserLdapAttribute: pulumi.String("cn"),
			UserRolesRetrieveStrategy:   pulumi.String("GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE"),
			MemberofLdapAttribute:       pulumi.String("memberOf"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });

    var ldapUserFederation = new Keycloak.Ldap.UserFederation("ldap_user_federation", new()
    {
        Name = "openldap",
        RealmId = realm.Id,
        UsernameLdapAttribute = "cn",
        RdnLdapAttribute = "cn",
        UuidLdapAttribute = "entryDN",
        UserObjectClasses = new[]
        {
            "simpleSecurityObject",
            "organizationalRole",
        },
        ConnectionUrl = "ldap://openldap",
        UsersDn = "dc=example,dc=org",
        BindDn = "cn=admin,dc=example,dc=org",
        BindCredential = "admin",
    });

    var ldapRoleMapper = new Keycloak.Ldap.RoleMapper("ldap_role_mapper", new()
    {
        RealmId = realm.Id,
        LdapUserFederationId = ldapUserFederation.Id,
        Name = "role-mapper",
        LdapRolesDn = "dc=example,dc=org",
        RoleNameLdapAttribute = "cn",
        RoleObjectClasses = new[]
        {
            "groupOfNames",
        },
        MembershipAttributeType = "DN",
        MembershipLdapAttribute = "member",
        MembershipUserLdapAttribute = "cn",
        UserRolesRetrieveStrategy = "GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE",
        MemberofLdapAttribute = "memberOf",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.ldap.UserFederation;
import com.pulumi.keycloak.ldap.UserFederationArgs;
import com.pulumi.keycloak.ldap.RoleMapper;
import com.pulumi.keycloak.ldap.RoleMapperArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .build());

        var ldapUserFederation = new UserFederation("ldapUserFederation", UserFederationArgs.builder()
            .name("openldap")
            .realmId(realm.id())
            .usernameLdapAttribute("cn")
            .rdnLdapAttribute("cn")
            .uuidLdapAttribute("entryDN")
            .userObjectClasses(            
                "simpleSecurityObject",
                "organizationalRole")
            .connectionUrl("ldap://openldap")
            .usersDn("dc=example,dc=org")
            .bindDn("cn=admin,dc=example,dc=org")
            .bindCredential("admin")
            .build());

        var ldapRoleMapper = new RoleMapper("ldapRoleMapper", RoleMapperArgs.builder()
            .realmId(realm.id())
            .ldapUserFederationId(ldapUserFederation.id())
            .name("role-mapper")
            .ldapRolesDn("dc=example,dc=org")
            .roleNameLdapAttribute("cn")
            .roleObjectClasses("groupOfNames")
            .membershipAttributeType("DN")
            .membershipLdapAttribute("member")
            .membershipUserLdapAttribute("cn")
            .userRolesRetrieveStrategy("GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE")
            .memberofLdapAttribute("memberOf")
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  ldapUserFederation:
    type: keycloak:ldap:UserFederation
    name: ldap_user_federation
    properties:
      name: openldap
      realmId: ${realm.id}
      usernameLdapAttribute: cn
      rdnLdapAttribute: cn
      uuidLdapAttribute: entryDN
      userObjectClasses:
        - simpleSecurityObject
        - organizationalRole
      connectionUrl: ldap://openldap
      usersDn: dc=example,dc=org
      bindDn: cn=admin,dc=example,dc=org
      bindCredential: admin
  ldapRoleMapper:
    type: keycloak:ldap:RoleMapper
    name: ldap_role_mapper
    properties:
      realmId: ${realm.id}
      ldapUserFederationId: ${ldapUserFederation.id}
      name: role-mapper
      ldapRolesDn: dc=example,dc=org
      roleNameLdapAttribute: cn
      roleObjectClasses:
        - groupOfNames
      membershipAttributeType: DN
      membershipLdapAttribute: member
      membershipUserLdapAttribute: cn
      userRolesRetrieveStrategy: GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE
      memberofLdapAttribute: memberOf

    Create RoleMapper Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RoleMapper(name: string, args: RoleMapperArgs, opts?: CustomResourceOptions);
    @overload
def RoleMapper(resource_name: str,
               args: RoleMapperArgs,
               opts: Optional[ResourceOptions] = None)

@overload
def RoleMapper(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               realm_id: Optional[str] = None,
               membership_user_ldap_attribute: Optional[str] = None,
               ldap_user_federation_id: Optional[str] = None,
               role_object_classes: Optional[Sequence[str]] = None,
               role_name_ldap_attribute: Optional[str] = None,
               membership_ldap_attribute: Optional[str] = None,
               ldap_roles_dn: Optional[str] = None,
               membership_attribute_type: Optional[str] = None,
               name: Optional[str] = None,
               client_id: Optional[str] = None,
               mode: Optional[str] = None,
               memberof_ldap_attribute: Optional[str] = None,
               roles_ldap_filter: Optional[str] = None,
               use_realm_roles_mapping: Optional[bool] = None,
               user_roles_retrieve_strategy: Optional[str] = None)
    func NewRoleMapper(ctx *Context, name string, args RoleMapperArgs, opts ...ResourceOption) (*RoleMapper, error)
    public RoleMapper(string name, RoleMapperArgs args, CustomResourceOptions? opts = null)
    public RoleMapper(String name, RoleMapperArgs args)
public RoleMapper(String name, RoleMapperArgs args, CustomResourceOptions options)

    type: keycloak:ldap:RoleMapper
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args RoleMapperArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RoleMapperArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RoleMapperArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RoleMapperArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RoleMapperArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var roleMapperResource = new Keycloak.Ldap.RoleMapper("roleMapperResource", new()
{
    RealmId = "string",
    MembershipUserLdapAttribute = "string",
    LdapUserFederationId = "string",
    RoleObjectClasses = new[]
    {
        "string",
    },
    RoleNameLdapAttribute = "string",
    MembershipLdapAttribute = "string",
    LdapRolesDn = "string",
    MembershipAttributeType = "string",
    Name = "string",
    ClientId = "string",
    Mode = "string",
    MemberofLdapAttribute = "string",
    RolesLdapFilter = "string",
    UseRealmRolesMapping = false,
    UserRolesRetrieveStrategy = "string",
});

    example, err := ldap.NewRoleMapper(ctx, "roleMapperResource", &ldap.RoleMapperArgs{
	RealmId:                     pulumi.String("string"),
	MembershipUserLdapAttribute: pulumi.String("string"),
	LdapUserFederationId:        pulumi.String("string"),
	RoleObjectClasses: pulumi.StringArray{
		pulumi.String("string"),
	},
	RoleNameLdapAttribute:     pulumi.String("string"),
	MembershipLdapAttribute:   pulumi.String("string"),
	LdapRolesDn:               pulumi.String("string"),
	MembershipAttributeType:   pulumi.String("string"),
	Name:                      pulumi.String("string"),
	ClientId:                  pulumi.String("string"),
	Mode:                      pulumi.String("string"),
	MemberofLdapAttribute:     pulumi.String("string"),
	RolesLdapFilter:           pulumi.String("string"),
	UseRealmRolesMapping:      pulumi.Bool(false),
	UserRolesRetrieveStrategy: pulumi.String("string"),
})

    var roleMapperResource = new RoleMapper("roleMapperResource", RoleMapperArgs.builder()
    .realmId("string")
    .membershipUserLdapAttribute("string")
    .ldapUserFederationId("string")
    .roleObjectClasses("string")
    .roleNameLdapAttribute("string")
    .membershipLdapAttribute("string")
    .ldapRolesDn("string")
    .membershipAttributeType("string")
    .name("string")
    .clientId("string")
    .mode("string")
    .memberofLdapAttribute("string")
    .rolesLdapFilter("string")
    .useRealmRolesMapping(false)
    .userRolesRetrieveStrategy("string")
    .build());

    role_mapper_resource = keycloak.ldap.RoleMapper("roleMapperResource",
    realm_id="string",
    membership_user_ldap_attribute="string",
    ldap_user_federation_id="string",
    role_object_classes=["string"],
    role_name_ldap_attribute="string",
    membership_ldap_attribute="string",
    ldap_roles_dn="string",
    membership_attribute_type="string",
    name="string",
    client_id="string",
    mode="string",
    memberof_ldap_attribute="string",
    roles_ldap_filter="string",
    use_realm_roles_mapping=False,
    user_roles_retrieve_strategy="string")

    const roleMapperResource = new keycloak.ldap.RoleMapper("roleMapperResource", {
    realmId: "string",
    membershipUserLdapAttribute: "string",
    ldapUserFederationId: "string",
    roleObjectClasses: ["string"],
    roleNameLdapAttribute: "string",
    membershipLdapAttribute: "string",
    ldapRolesDn: "string",
    membershipAttributeType: "string",
    name: "string",
    clientId: "string",
    mode: "string",
    memberofLdapAttribute: "string",
    rolesLdapFilter: "string",
    useRealmRolesMapping: false,
    userRolesRetrieveStrategy: "string",
});

    type: keycloak:ldap:RoleMapper
properties:
    clientId: string
    ldapRolesDn: string
    ldapUserFederationId: string
    memberofLdapAttribute: string
    membershipAttributeType: string
    membershipLdapAttribute: string
    membershipUserLdapAttribute: string
    mode: string
    name: string
    realmId: string
    roleNameLdapAttribute: string
    roleObjectClasses:
        - string
    rolesLdapFilter: string
    useRealmRolesMapping: false
    userRolesRetrieveStrategy: string

    RoleMapper Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The RoleMapper resource accepts the following input properties:

    LdapRolesDn string
    The LDAP DN where roles can be found.
    LdapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    MembershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    MembershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    RealmId string
    The realm that this LDAP mapper will exist in.
    RoleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    RoleObjectClasses List<string>
    List of strings representing the object classes for the role. Must contain at least one.
    ClientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    MemberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    MembershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    Mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    Name string
    Display name of this mapper when displayed in the console.
    RolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    UseRealmRolesMapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    UserRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    LdapRolesDn string
    The LDAP DN where roles can be found.
    LdapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    MembershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    MembershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    RealmId string
    The realm that this LDAP mapper will exist in.
    RoleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    RoleObjectClasses []string
    List of strings representing the object classes for the role. Must contain at least one.
    ClientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    MemberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    MembershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    Mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    Name string
    Display name of this mapper when displayed in the console.
    RolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    UseRealmRolesMapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    UserRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    ldapRolesDn String
    The LDAP DN where roles can be found.
    ldapUserFederationId String
    The ID of the LDAP user federation provider to attach this mapper to.
    membershipLdapAttribute String
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute String
    The name of the LDAP attribute on a user that is used for membership mappings.
    realmId String
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute String
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses List<String>
    List of strings representing the object classes for the role. Must contain at least one.
    clientId String
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    memberofLdapAttribute String
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType String
    Can be one of DN or UID. Defaults to DN.
    mode String
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name String
    Display name of this mapper when displayed in the console.
    rolesLdapFilter String
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping Boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy String
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    ldapRolesDn string
    The LDAP DN where roles can be found.
    ldapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    membershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    realmId string
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses string[]
    List of strings representing the object classes for the role. Must contain at least one.
    clientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    memberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name string
    Display name of this mapper when displayed in the console.
    rolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    ldap_roles_dn str
    The LDAP DN where roles can be found.
    ldap_user_federation_id str
    The ID of the LDAP user federation provider to attach this mapper to.
    membership_ldap_attribute str
    The name of the LDAP attribute that is used for membership mappings.
    membership_user_ldap_attribute str
    The name of the LDAP attribute on a user that is used for membership mappings.
    realm_id str
    The realm that this LDAP mapper will exist in.
    role_name_ldap_attribute str
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    role_object_classes Sequence[str]
    List of strings representing the object classes for the role. Must contain at least one.
    client_id str
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    memberof_ldap_attribute str
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membership_attribute_type str
    Can be one of DN or UID. Defaults to DN.
    mode str
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name str
    Display name of this mapper when displayed in the console.
    roles_ldap_filter str
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    use_realm_roles_mapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    user_roles_retrieve_strategy str
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    ldapRolesDn String
    The LDAP DN where roles can be found.
    ldapUserFederationId String
    The ID of the LDAP user federation provider to attach this mapper to.
    membershipLdapAttribute String
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute String
    The name of the LDAP attribute on a user that is used for membership mappings.
    realmId String
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute String
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses List<String>
    List of strings representing the object classes for the role. Must contain at least one.
    clientId String
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    memberofLdapAttribute String
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType String
    Can be one of DN or UID. Defaults to DN.
    mode String
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name String
    Display name of this mapper when displayed in the console.
    rolesLdapFilter String
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping Boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy String
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RoleMapper resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing RoleMapper Resource

    Get an existing RoleMapper resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RoleMapperState, opts?: CustomResourceOptions): RoleMapper
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        client_id: Optional[str] = None,
        ldap_roles_dn: Optional[str] = None,
        ldap_user_federation_id: Optional[str] = None,
        memberof_ldap_attribute: Optional[str] = None,
        membership_attribute_type: Optional[str] = None,
        membership_ldap_attribute: Optional[str] = None,
        membership_user_ldap_attribute: Optional[str] = None,
        mode: Optional[str] = None,
        name: Optional[str] = None,
        realm_id: Optional[str] = None,
        role_name_ldap_attribute: Optional[str] = None,
        role_object_classes: Optional[Sequence[str]] = None,
        roles_ldap_filter: Optional[str] = None,
        use_realm_roles_mapping: Optional[bool] = None,
        user_roles_retrieve_strategy: Optional[str] = None) -> RoleMapper
    func GetRoleMapper(ctx *Context, name string, id IDInput, state *RoleMapperState, opts ...ResourceOption) (*RoleMapper, error)
    public static RoleMapper Get(string name, Input<string> id, RoleMapperState? state, CustomResourceOptions? opts = null)
    public static RoleMapper get(String name, Output<String> id, RoleMapperState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:ldap:RoleMapper    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ClientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    LdapRolesDn string
    The LDAP DN where roles can be found.
    LdapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    MemberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    MembershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    MembershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    MembershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    Mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    Name string
    Display name of this mapper when displayed in the console.
    RealmId string
    The realm that this LDAP mapper will exist in.
    RoleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    RoleObjectClasses List<string>
    List of strings representing the object classes for the role. Must contain at least one.
    RolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    UseRealmRolesMapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    UserRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    ClientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    LdapRolesDn string
    The LDAP DN where roles can be found.
    LdapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    MemberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    MembershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    MembershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    MembershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    Mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    Name string
    Display name of this mapper when displayed in the console.
    RealmId string
    The realm that this LDAP mapper will exist in.
    RoleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    RoleObjectClasses []string
    List of strings representing the object classes for the role. Must contain at least one.
    RolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    UseRealmRolesMapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    UserRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    clientId String
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    ldapRolesDn String
    The LDAP DN where roles can be found.
    ldapUserFederationId String
    The ID of the LDAP user federation provider to attach this mapper to.
    memberofLdapAttribute String
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType String
    Can be one of DN or UID. Defaults to DN.
    membershipLdapAttribute String
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute String
    The name of the LDAP attribute on a user that is used for membership mappings.
    mode String
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name String
    Display name of this mapper when displayed in the console.
    realmId String
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute String
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses List<String>
    List of strings representing the object classes for the role. Must contain at least one.
    rolesLdapFilter String
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping Boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy String
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    clientId string
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    ldapRolesDn string
    The LDAP DN where roles can be found.
    ldapUserFederationId string
    The ID of the LDAP user federation provider to attach this mapper to.
    memberofLdapAttribute string
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType string
    Can be one of DN or UID. Defaults to DN.
    membershipLdapAttribute string
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute string
    The name of the LDAP attribute on a user that is used for membership mappings.
    mode string
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name string
    Display name of this mapper when displayed in the console.
    realmId string
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute string
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses string[]
    List of strings representing the object classes for the role. Must contain at least one.
    rolesLdapFilter string
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy string
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    client_id str
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    ldap_roles_dn str
    The LDAP DN where roles can be found.
    ldap_user_federation_id str
    The ID of the LDAP user federation provider to attach this mapper to.
    memberof_ldap_attribute str
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membership_attribute_type str
    Can be one of DN or UID. Defaults to DN.
    membership_ldap_attribute str
    The name of the LDAP attribute that is used for membership mappings.
    membership_user_ldap_attribute str
    The name of the LDAP attribute on a user that is used for membership mappings.
    mode str
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name str
    Display name of this mapper when displayed in the console.
    realm_id str
    The realm that this LDAP mapper will exist in.
    role_name_ldap_attribute str
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    role_object_classes Sequence[str]
    List of strings representing the object classes for the role. Must contain at least one.
    roles_ldap_filter str
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    use_realm_roles_mapping bool
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    user_roles_retrieve_strategy str
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.
    clientId String
    When specified, LDAP role mappings will be mapped to client role mappings tied to this client ID. Can only be set if use_realm_roles_mapping is false.
    ldapRolesDn String
    The LDAP DN where roles can be found.
    ldapUserFederationId String
    The ID of the LDAP user federation provider to attach this mapper to.
    memberofLdapAttribute String
    Specifies the name of the LDAP attribute on the LDAP user that contains the roles the user has. Defaults to memberOf. This is only used when
    membershipAttributeType String
    Can be one of DN or UID. Defaults to DN.
    membershipLdapAttribute String
    The name of the LDAP attribute that is used for membership mappings.
    membershipUserLdapAttribute String
    The name of the LDAP attribute on a user that is used for membership mappings.
    mode String
    Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
    name String
    Display name of this mapper when displayed in the console.
    realmId String
    The realm that this LDAP mapper will exist in.
    roleNameLdapAttribute String
    The name of the LDAP attribute that is used in role objects for the name and RDN of the role. Typically cn.
    roleObjectClasses List<String>
    List of strings representing the object classes for the role. Must contain at least one.
    rolesLdapFilter String
    When specified, adds a custom filter to be used when querying for roles. Must start with ( and end with ).
    useRealmRolesMapping Boolean
    When true, LDAP role mappings will be mapped to realm roles within Keycloak. Defaults to true.
    userRolesRetrieveStrategy String
    Can be one of LOAD_ROLES_BY_MEMBER_ATTRIBUTE, GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_ROLES_BY_MEMBER_ATTRIBUTE.

    Import

    LDAP mappers can be imported using the format {{realm_id}}/{{ldap_user_federation_id}}/{{ldap_mapper_id}}.

    The ID of the LDAP user federation provider and the mapper can be found within the Keycloak GUI, and they are typically GUIDs.

    Example:

    bash

    $ pulumi import keycloak:ldap/roleMapper:RoleMapper ldap_role_mapper my-realm/af2a6ca3-e4d7-49c3-b08b-1b3c70b4b860/3d923ece-1a91-4bf7-adaf-3b82f2a12b67

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo
    Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
    pulumi/pulumi-keycloak