[midPoint] Active Directory and Keycloak connector Issues with Group Membership Provisioning in midPoint 4.10.2
Nemo Van den Eynde
nemo.vandeneynde at acen.eu
Wed Jul 8 12:04:24 CEST 2026
Hello Habtamu,
For group memberships to be provisioned correctly, I work with this configuration.
First you configure a reference in the capabilities:
<cap:references>
<cap:type>
<cap:name>groupMembership</cap:name>
<cap:subject>
<cap:delineation>
<cap:objectClass>ri:user</cap:objectClass>
</cap:delineation>
<cap:primaryBindingAttributeRef>groups</cap:primaryBindingAttributeRef>
<cap:localItemName>groupMemberships</cap:localItemName>
</cap:subject>
<cap:object>
<cap:delineation>
<cap:objectClass>ri:group</cap:objectClass>
</cap:delineation>
<cap:primaryBindingAttributeRef>groupId</cap:primaryBindingAttributeRef>
</cap:object>
<cap:direction>subjectToObject</cap:direction>
</cap:type>
</cap:references>
After that you can make an association type:
<associationType>
<name>groupMembershipsAssociation</name>
<subject>
<objectType>
<kind>account</kind>
<intent>account</intent>
</objectType>
<association>
<ref>groupMemberships</ref>
<sourceAttributeRef>groupMemberships</sourceAttributeRef>
<outbound>
<name>outboundGroupAssociation</name>
<expression>
<associationConstruction xsi:type="c:AssociationConstructionExpressionEvaluatorType"/>
</expression>
</outbound>
<inbound>
<name>inbound association</name>
<expression>
<associationSynchronization xsi:type="c:AssociationSynchronizationExpressionEvaluatorType">
<objectRef>
<ref>groupMemberships</ref>
<mapping>
<name>inbound-memberships</name>
<strength>strong</strength>
<expression>
<shadowOwnerReferenceSearch/>
</expression>
<target>
<path>targetRef</path>
</target>
</mapping>
</objectRef>
<correlation>
<correlators>
<items>
<name>correlate</name>
<item>
<ref>targetRef</ref>
</item>
</items>
</correlators>
</correlation>
<synchronization>
<reaction>
<name>unmatched</name>
<situation>unmatched</situation>
<actions>
<addFocusValue/>
</actions>
</reaction>
<reaction">
<name>matched</name>
<situation>matched</situation>
<actions>
<synchronize/>
</actions>
</reaction>
</synchronization>
</associationSynchronization>
</expression>
</inbound>
<tolerant>true</tolerant>
</association>
</subject>
<object>
<objectType>
<kind>entitlement</kind>
<intent>group</intent>
</objectType>
</object>
</associationType>
I have also attached my test environment config file with some more associations configured, note that this one uses my own experimental build of the keycloak connector but groupMembership should be unchanged.
I hope this helps you with your keycloak connector troubles.
Kind Regards,
Nemo Van den Eynde
IGA Engineer
[Logo]<https://www.acen.eu/>
[https://img2.gimm.io/a4c6f625-9220-4efe-83d2-48e568599c1a/image.png]
+32 465 00 12 21
[https://img2.gimm.io/10e53e9d-763a-4be6-98fa-eeca2977a790/image.png]
nemo.vandeneynde at acen.eu <mailto:nemo.vandeneynde at acen.eu>
[https://img2.gimm.io/1ae8c26f-8371-4eb1-a439-7868d9a3610d/image.png]
www.acen.eu <http://www.acen.eu/>
[https://img2.gimm.io/32ff85f7-5c98-464f-8114-1fd12ac5e149/image.png]
Veldkant 7, 2550 Kontich <https://maps.app.goo.gl/M4nC67m22KWx2XE2A>
[https://img2.gimm.io/95d2ac0a-846f-4eab-b7d1-27a6ac793a95/image.png]
Discover our jobs <https://www.acen.eu/en/working-at-acen/>
[https://img2.gimm.io/e875ab9e-8ef1-4573-9dd2-d378f95d82ed/image.png]
Follow us <https://www.linkedin.com/company/98341614/admin/feed/posts/?feedType=following>
________________________________
From: midPoint <midpoint-bounces at lists.evolveum.com> on behalf of Habtamu Wubneh via midPoint <midpoint at lists.evolveum.com>
Sent: Tuesday, July 7, 2026 15:46
To: midpoint at lists.evolveum.com <midpoint at lists.evolveum.com>
Cc: Habtamu Wubneh <habtamuwubneh5 at gmail.com>
Subject: [midPoint] Active Directory and Keycloak connector Issues with Group Membership Provisioning in midPoint 4.10.2
Dear midPoint Support Team,
I hope this email finds you well. I am currently facing several issues
while trying to provision users and group memberships from midPoint
(version 4.10.2) to both Keycloak (version 24.0.5) and Active
Directory using the AD/LDAP connector. I would appreciate your
assistance in resolving these challenges.
Environment Details
Component Version
midPoint 4.10.2 (Docker: evolveum/midpoint:4.10.2-alpine)
Keycloak 24.0.5 (Docker: quay.io/keycloak/keycloak:24.0.5)
Keycloak Connectorjp.openstandia.connector.keycloak.Keycloak Connector
v1.1.7-SNAPSHOT
AD/LDAP Connectorcom.evolveum.polygon.connector.ldap.ad.AdLdapConnector
Deployment Docker Compose
Part 1: Keycloak Connector Issues
Issue 1.1: User Provisioning Works, but Group Memberships Are Not Provisioned
When I create a user in midPoint and assign them a role (which should
map to a Keycloak group), the user is successfully created in
Keycloak, but:
The user is NOT added to the group (the Members tab in Keycloak Groups
shows no members)
The user's Member Of section is empty
Issue 1.2: Invalid XML Syntax for Attribute Mappings in midPoint 4.10.2
I have tried multiple approaches to map the ri:groups attribute, but I
keep encountering XML validation errors:
Attempt 1: Using script under source
text
Error: No field 'script' in class class
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType
Attempt 2: Using expression with script
text
Error: No field 'expression' in class class
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType
Attempt 3: Using value under source
text
Error: No field 'value' in class class
com.evolveum.midpoint.xml.ns._public.common.common_3.VariableBindingDefinitionType
Attempt 4: Using constant: prefix
text
Error: This works but does not resolve the role name dynamically
Attempt 5: Using association for groups
text
Error: Legacy association 'groups' is already defined as an attribute
in resource association definition for 'groups' in object type
ACCOUNT/default
Issue 1.3: Role Inducement Not Creating Groups
When I create a role with an inducement to create a group in Keycloak:
xml
<inducement>
<construction>
<resourceRef oid="9beeeddb-10ca-42c8-8ba0-734d519e4bee"/>
<kind>entitlement</kind>
<intent>group</intent>
<attribute>
<ref>ri:name</ref>
<value>InitiativeOwner</value>
</attribute>
</construction>
</inducement>
The group is not created in Keycloak unless the role's name matches
the group name.
Issue 1.4: Correlation Not Working as Expected
The correlation mechanism does not seem to work properly. When
multiple users are assigned the same role, midPoint tries to create a
new group for each user instead of adding them to the existing group.
This results in:
Duplicate groups being created (or conflicts)
The ri:groups attribute is not being used for correlation
Issue 1.5: Casting Error When Using roleMembershipRef
When trying to map roleMembershipRef directly to ri:groups, I get:
text
Error: class com.evolveum.midpoint.prism.impl.PrismReferenceValueImpl
cannot be cast to class com.evolveum.midpoint.prism.PrismPropertyValue
________________________________
Part 2: AD/LDAP Connector Issues
Issue 2.1: Group Synchronization Problems
Based on the AD/LDAP connector documentation, configuring group
synchronization requires specific settings. I am facing issues with:
Group object synchronization - Groups are not being synchronized
properly between midPoint and AD
Group membership provisioning - Users are not being added to groups in AD
Issue 2.2: Association Configuration Challenges
According to the official documentation, the AD/LDAP connector
requires specific association configuration for group memberships:
xml
<association>
<ref>ri:group</ref>
<displayName>AD Group Membership</displayName>
<kind>entitlement</kind>
<intent>group</intent>
<direction>objectToSubject</direction>
<associationAttribute>ri:member</associationAttribute>
<valueAttribute>ri:dn</valueAttribute>
<shortcutAssociationAttribute>ri:memberOf</shortcutAssociationAttribute>
<shortcutValueAttribute>ri:dn</shortcutValueAttribute>
<explicitReferentialIntegrity>false</explicitReferentialIntegrity>
</association>
However, I'm encountering issues with this configuration not working
as expected.
Issue 2.3: Administrative Account Privileges
The documentation states that the administrative account used by
midPoint needs specific privileges:
Create, delete and manage user accounts
Reset user passwords and force password change at next logon
Read all user information
Create, delete and manage groups
Modify the membership of a group
I have confirmed these privileges are assigned, but group membership
still fails.
Issue 2.4: LDAP Search Errors
I am also experiencing LDAP search errors similar to those documented
in the midPoint bug tracker:
text
LDAP error during search: operationsError: 00002120: SvcErr:
DSID-03120496, problem 5012 (DIR_ERROR), data 592060
This appears to be related to group object processing from Active Directory.
Issue 2.5: Association Outbound Mapping Configuration
The documentation mentions that for provisioning users with group
memberships, you need to configure the outbound mapping for
associations. I have tried both the association approach and the
attribute approach, but neither is working consistently.
According to the group synchronization HOWTO, groups should be
synchronized with roles using the following configuration:
xml
<objectSynchronization>
<enabled>true</enabled>
<objectClass>ri:CustomGroupObjectClass</objectClass>
<kind>entitlement</kind>
<intent>group</intent>
<focusType>c:RoleType</focusType>
<!-- correlation and reactions -->
</objectSynchronization>
I have configured this but it's not working as expected.
________________________________
What I'm Trying to Achieve
Keycloak: Create a role in midPoint that represents a group in
Keycloak, assign users to this role, and automatically provision both
the group and the user's membership
AD/LDAP: Similarly, synchronize users and groups between midPoint and
Active Directory, ensuring group memberships are properly provisioned
Questions
For Keycloak Connector:
What is the correct XML syntax for mapping ri:groups to a dynamic role
name in midPoint 4.10.2?
What is the correct way to create groups via role inducements in
midPoint 4.10.2?
How should I configure correlation to prevent duplicate group creation
when assigning multiple users to the same role?
Should I use attribute or association for group memberships in the
schemaHandling?
For AD/LDAP Connector:
What is the correct configuration for group membership provisioning
with the AD/LDAP connector in midPoint 4.10.2?
Are there specific settings required for managedAssociationPairs and
explicitReferentialIntegrity that I might be missing?
Is there a known issue with the AD/LDAP connector and group
synchronization in midPoint 4.10.2?
Could the LDAP search error be related to the connector version or
configuration?
________________________________
Current Resource Configuration (Simplified)
Keycloak Resource
xml
<schemaHandling>
<objectType id="4">
<kind>account</kind>
<intent>default</intent>
<delineation>
<objectClass>ri:user</objectClass>
</delineation>
<!-- User attributes mapping -->
<attribute>
<ref>ri:username</ref>
<outbound>
<source>
<path>name</path>
</source>
</outbound>
</attribute>
<!-- ❌ Groups mapping not working -->
<attribute>
<ref>ri:groups</ref>
<outbound>
<source>
<path>constant:InitiativeOwner</path>
</source>
</outbound>
</attribute>
</objectType>
</schemaHandling>
AD/LDAP Resource
xml
<connectorConfiguration>
<icfc:configurationProperties>
<icfcldap:host>ad.example.com</icfcldap:host>
<icfcldap:port>636</icfcldap:port>
<icfcldap:baseContext>DC=example,DC=com</icfcldap:baseContext>
<icfcldap:bindDn>CN=midpoint,CN=Users,DC=example,DC=com</icfcldap:bindDn>
<icfcldap:connectionSecurity>ssl</icfcldap:connectionSecurity>
<icfcldap:pagingBlockSize>100</icfcldap:pagingBlockSize>
</icfc:configurationProperties>
</connectorConfiguration>
________________________________
I would greatly appreciate any guidance on the correct configuration
for both connectors in midPoint 4.10.2. Please let me know if you need
any additional information, logs, or configuration details.
Thank you for your time and support.
Best regards,
Habtamu Wubneh Yirdaw'
Senior IT Architecture and Modernization Officer
phone: +251938101164
email: habtamuwubneh5 at gmail.com
_______________________________________________
midPoint mailing list
midPoint at lists.evolveum.com
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.evolveum.com%2Fmailman%2Flistinfo%2Fmidpoint&data=05%7C02%7Cnemo.vandeneynde%40is4u.be%7C7713d2eacc8748d4ee4308dedcc8eaaf%7C49c3d703357947bfa8887c913fbdced9%7C0%7C0%7C639190952723817609%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=GL05mBzvxs%2FzEYBGQDqAOkyKgVHdBXEqVsdjs0UFF40%3D&reserved=0<https://lists.evolveum.com/mailman/listinfo/midpoint>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260708/1f39b42e/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak.xml
Type: text/xml
Size: 35285 bytes
Desc: keycloak.xml
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20260708/1f39b42e/attachment-0001.xml>
More information about the midPoint
mailing list