将用户从 Azure AD 联合到 Keycloak 的最佳方法是什么？

Question

I haven't found a clear answer addressing this topic, which is surprising given that it seems like a common scenario. Can anyone provide some guidance or resources for setting up this type of user federation?

I have done some research and learned that Keycloak can accept Kerberos or LDAP user federation, but this source claims that Azure AD does not support LDAP. Despite this, I haven't found a clear "best option" for this process. I'm hoping someone who has actually set up this type of federation can provide some guidance or resources to help me achieve this goal.

Answer 1

You can connect Azure AD and KeyCloak via SAML2 and an app registration in Azure AD. Alphabold has a nice article about creating this setup.

In short the steps are:

• Create an app registration for KeyCloak in Azure AD
• Set the redirect URI for the app registration to your KeyCloak Realm URL
• Copy the Federation Metadata URL from the endpoint info for the app registration
• Create ID provider in KeyCloak as a SAML v2.2 provider
• Add the Federation Metadata URL to the Import External IDP config section
• Validation