# User Federation

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F74ARAroufTTopJZnC3p2%2Fimage.png?alt=media&#x26;token=7656b7b6-344d-4169-9f51-3f60b1af3c71" alt=""><figcaption></figcaption></figure>

It enables ZTrust to establish connections with external user databases.

Upon selecting Add Kerberos providers, you will be directed to the screen below.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FlePnVSjurYu1HTXmI7Lt%2F56.png?alt=media&#x26;token=33170965-bd03-4278-9fdd-507c2b394424" alt=""><figcaption></figcaption></figure>

#### **UI Display Name**

This indicates the display name of the provider when linked in the admin console.

#### **Kerberos Realm**

This refers to the complete name of the server principal for the HTTP service, including the server and domain name.

#### **Server Principal**

This refers to the complete name of the server principal for the HTTP service, including the server and domain name.

#### **KeyTab**

This indicates the location of the Kerberos KeyTab file containing the credentials of the server principal.

#### **Debug**

This toggle button, when activated (toggled ON), enables debug logging to standard output for the Krb5LoginModule.

When deactivated (toggled OFF), debug logging is disabled.

You can adjust this setting based on your requirements by toggling it ON or OFF.

#### **Allow Password Authentication**

This toggle button, when activated (toggled ON), enables the option for username/password authentication against the Kerberos database.&#x20;

When deactivated (toggled OFF), this option is disabled.

You can adjust this setting based on your requirements by toggling it ON or OFF.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FdeYswlR6MRWxh27sBCJJ%2F57.png?alt=media&#x26;token=00753cdd-3614-45d4-90aa-a06c6ac66cce" alt=""><figcaption></figcaption></figure>

#### **Edit mode**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fm0ic34KiKteDQywpo3bF%2F58.png?alt=media&#x26;token=773900f2-7dbc-4f62-8963-779a74383c7c" alt=""><figcaption></figcaption></figure>

This setting has two values:

* READ\_ONLY: Indicates a read-only LDAP store.
* UNSYNCED: Implies that user data will be imported but not synced back to LDAP.

You can choose the most suitable option from the dropdown based on your needs.

#### **Update Profile First Login**

It is a toggle button, when enabled (turned ON), profile has to be updated on first login.

When disabled (toggled OFF), update profile after first login  is not required.

You can toggle it ON or OFF based on your requirements.&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FHZHwv8tIieiSDOrIBy5v%2F59.png?alt=media&#x26;token=1c41cfd5-0009-4069-8944-d27682850bf5" alt=""><figcaption></figcaption></figure>

#### **Cache policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FAzbNWaTvqMoT6EtJvant%2F60.png?alt=media&#x26;token=d77c756c-d0b5-4005-865a-9440d0c0fea7" alt=""><figcaption></figcaption></figure>

This is the cache policy for this storage provider, which can have the following values:

* Default: Indicates whatever the default settings are for the global cache.
* Evict\_Daily: Specifies the time of day every day that the cache will be invalidated.
* Evict\_Weekly: Indicates the day of the week and time the cache will be invalidated.
* Max\_Lifespan: Refers to the time in milliseconds that will be the lifespan of a cache entry.
* No\_Cache: Indicates that no cache invalidation is required.

You can choose the most suitable option based on your needs.

#### **Save**

After making some changes, if you want to apply those changes, click on Save to implement those changes.

#### **Cancel**

If you decide not to apply the changes, click on Cancel to discard them.



Upon selecting LDAP, you will be directed to the following screen.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FkYEFpIdU4Ek5gUvOIg9I%2F61.png?alt=media&#x26;token=84c5b9d2-4c0d-4b50-b44f-41911eb61c8d" alt=""><figcaption></figcaption></figure>

### **General options**

#### **UI Display Name**

This indicates the display name of the provider when linked in the admin console.

#### **Vendor**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FHmqMTalLGHimfJ4cOxrG%2F62.png?alt=media&#x26;token=5c781c4c-700a-4104-8979-e2a985447310" alt=""><figcaption></figcaption></figure>

This indicates the LDAP vendor or provider.

You can select the most suitable option based on your requirements from the dropdown menu.

### **Connection and authentication settings**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FM9cxIMESRpMlkbL0WolZ%2F63.png?alt=media&#x26;token=80b2fb67-770b-4233-aec8-91b4e9fc2267" alt=""><figcaption></figcaption></figure>

#### **Connection URL**

This indicates the connection URL to your LDAP Server.

#### **Enable StartTLS**

This toggle button, when activated (toggled ON), encrypts the connection to LDAP using STARTTLS, which disables [connection pooling](../../../user-manual-ztrust-v2.0/key-terminologies#connection-pooling).

When deactivated (toggled OFF), there is no encryption applied.

You can adjust it according to your needs by toggling it ON or OFF.

#### **Use Truststore SPI**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FkTjdbuOiKh3cqpuw9ZxU%2F64.png?alt=media&#x26;token=1027be0f-5770-4862-9e37-79d12ef30be5" alt=""><figcaption></figcaption></figure>

This setting specifies whether the LDAP connection will utilize the truststore SPI with the configured truststore. It can take two values:

* Always: It will always use the truststore SPI.
* Never: It will not use the truststore SPI.

You can select the most suitable option from the dropdown based on your requirements.

#### **Connection Pooling**

This toggle button, when activated (toggled ON), indicates that ZTrust should use Connection Pooling for accessing the LDAP Server.

When deactivated (toggled OFF), ZTrust does not use Connection Pooling.

You can adjust this setting according to your requirements by toggling it ON or OFF.

#### **Connection Timeout**

This setting determines the LDAP connection timeout duration, measured in milliseconds.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FaZcgtGvz4aUoC0KrLIUe%2F78.png?alt=media&#x26;token=53f6af7a-da56-4350-b51e-30776c33d926" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FzdT4r8KKsw9rGjoluY42%2F79.png?alt=media&#x26;token=63ab130a-66f9-42d7-a750-7f855388c995" alt=""><figcaption></figcaption></figure>

#### **Bind type**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FldvrbT0rnAdAGB2toCxN%2F65.png?alt=media&#x26;token=d940fb55-be27-41bc-abb6-3509dd412f34" alt=""><figcaption></figcaption></figure>

This specifies the type of authentication method used during LDAP Bind operation, which is utilized in most requests sent to the LDAP server.

It can have two values:

* None: Indicates anonymous LDAP authentication.
* Simple: Refers to Bind Credential + Bind Password authentication.

You can select the preferred option from the dropdown according to your requirements.

#### **Bind DN**

It refers to the DN of LDAP Admin, which will be used by ZTrust to access LDAP

#### **Bind Credential**

This specifies the password of LDAP Admin.

#### **LDAP searching and updating**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FslGXrLv765YgSHxibA4J%2F66.png?alt=media&#x26;token=2da74ec2-b23d-49e4-925d-f2ca827dcbfc" alt=""><figcaption></figcaption></figure>

#### **Edit mode**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F9biqKpfT3rSTlW8FfL3g%2F67.png?alt=media&#x26;token=fd2eaaf1-4a6e-48fe-8fae-805153a8fa79" alt=""><figcaption></figcaption></figure>

This setting has three values:

* READ\_ONLY: Indicates a read-only LDAP store.
* WRITABLE: Signifies that data will be synced back to LDAP on demand.
* UNSYNCED: Implies that user data will be imported but not synced back to LDAP.

You can choose the most suitable option from the dropdown based on your needs.

#### **Users DN**

This specifies the full DN of the LDAP tree where your users are located.

This DN is a parent of LDAP Users.

#### **Username LDAP attribute**

This specifies the name of the LDAP attribute that is mapped as the Keycloak username.

#### **RDN LDAP attribute**

It indicates the name of the LDAP attribute that is used as the RDN (top attribute) of the typical user DN.&#x20;

Typically, it is the same as the username LDAP attribute, but it is not required to be so.

#### **UUID LDAP attribute**

This specifies the name of the LDAP attribute that is used as the unique object identifier for objects in LDAP. While for many LDAP server vendors it is the entry UUID, some may use different attributes.

If your LDAP server does not support the notion of UUID, you can choose any other attribute that is supposed to be unique among LDAP users in the tree.

#### **User Object Classes**

It specifies the objectClass attribute values for users in LDAP, separated by commas.&#x20;

When new ZTrust users are created, they will have all these object classes assigned.

Existing LDAP user records will only be retrieved if they include all of these object classes.

#### **User LDAP filter**

This pertains to the additional LDAP filter used for filtering searched users.

If you don't want any additional filter, you can leave this field empty.

#### **Search scope**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FSflB4fbRG1cRxVwjYT96%2F68.png?alt=media&#x26;token=f72ed6cd-cdbc-44d3-9f74-722af5b90d13" alt=""><figcaption></figcaption></figure>

This setting can have two values:

* One Level: The search applies only to users in the DNs specified by the User DNs.
* Subtree: The search applies to the entire subtree.

You can select your preferred option from the dropdown based on your requirements.

#### **Read timeout**

This setting specifies the LDAP read timeout duration, measured in milliseconds.

It applies to LDAP read operations.

#### **Pagination**

This toggle button, when activated (toggled ON), indicates that the LDAP server supports [pagination](broken-reference). When deactivated (toggled OFF), the LDAP server does not support pagination.

You can adjust it according to your requirements by toggling it ON or OFF.

#### **Referral**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FbMQkQKLbY4nu8I8byz6I%2F69.png?alt=media&#x26;token=79ab4f64-804d-45cc-bfb2-91b30b12a8a1" alt=""><figcaption></figcaption></figure>

This setting determines whether LDAP referrals should be followed or ignored. If referrals are enabled, authentication may slow down since the LDAP server can direct queries to other LDAP servers, potentially including untrusted ones.

### **Synchronization settings**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FhcF3cn1PwslV5v5KWG2v%2F70.png?alt=media&#x26;token=7ceaa35d-0f91-43b0-9533-c7c8308777be" alt=""><figcaption></figcaption></figure>

#### **Import users**

This toggle button, when activated (toggled ON), indicates that LDAP users will be imported into the Keycloak database and synced according to the configured sync policies.

When deactivated (toggled OFF), the users will not be imported.

You can adjust this setting according to your requirements by toggling it ON or OFF.

#### **Sync Registrations**

This toggle button, when activated (toggled ON), indicates that newly created users will be created within the LDAP Store.

The priority affects which provider is chosen to sync the new user.

When deactivated (toggled OFF), newly created users will not be created within the LDAP Store.

You can adjust this setting according to your requirements by toggling it ON or OFF.

#### **Batch Size**

This indicates the count of LDAP users that must be imported from LDAP to ZTrust within a single transaction.

#### **Periodic Full Sync**

This toggle button, when activated (toggled ON), enables full synchronization of LDAP users to Ztrust. When deactivated (toggled OFF), full synchronization of LDAP users is disabled.&#x20;

You can adjust this setting based on your requirements by toggling it ON or OFF.

Enabling this option activates another field called Full Sync Period.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FBCKRE9tn28ttKIQxXkkN%2F71.png?alt=media&#x26;token=04cf8085-d7dd-45f1-8116-356503a5442d" alt=""><figcaption></figcaption></figure>

#### **Full Sync Period**

This specifies the duration for full synchronization in seconds.

#### **Periodic Changed Users Sync**

This toggle button, when activated (turned ON), enables periodic synchronization of changed or newly created LDAP users to ZTrust.&#x20;

When deactivated (turned OFF), periodic synchronization of changed or newly created LDAP users to ZTrust will not be enabled.&#x20;

You can adjust this setting based on your requirements by toggling it ON or OFF.

When enabled, it will also enable another field - Changed Users Sync Period

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FNyq16qZ0cChu50ILzVta%2F72.png?alt=media&#x26;token=593864c1-9c21-48d1-81dd-c95bc30b82e1" alt=""><figcaption></figcaption></figure>

#### **Changed Users Sync Period**

This specifies the duration for the synchronization of changed or newly created LDAP users in seconds.

### **Kerberos integration**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F4FV60eddUbGzEHw4Y57J%2F73.png?alt=media&#x26;token=756d45f9-5a06-42f9-8545-7044dfb89e3c" alt=""><figcaption></figcaption></figure>

#### **Allow Kerberos authentication**

This toggle button, when activated (toggled ON), allows HTTP authentication of users with SPNEGO/Kerberos tokens. User authentication data will be provisioned from this LDAP Server.

When deactivated (toggled OFF), HTTP authentication of users with SPNEGO/Kerberos tokens is disabled.&#x20;

You can adjust it according to your requirements by toggling it ON or OFF.

Once enabled (toggled ON), it will enable the below settings

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FXX86O51Yi008Q6tXJlV3%2F74.png?alt=media&#x26;token=922f7a71-9546-41f7-a606-aef648af6fa8" alt=""><figcaption></figcaption></figure>

#### **Kerberos realm**

It specifies the name of the Kerberos realm that you want to integrate with your LDAP system.

#### **Server principal**

It refers to the complete name of the server principal for the HTTP service, including both the server and domain name.

#### **Key tab**

It indicates the location of the Kerberos KeyTab file, which contains the credentials of the server principal.

#### **Kerberos principal attribute**

It denotes the LDAP attribute name that corresponds to the Kerberos principal. This attribute is used to locate the appropriate LDAP users following successful Kerberos authentication.&#x20;

If left empty, the LDAP user will be identified based on the LDAP username that matches the first part of the Kerberos principal.

#### **Debug**

It is a toggle button, when enabled (toggled ON), activates debug logging to the standard output for Krb5LoginModule.&#x20;

When toggled OFF, it deactivates this debug logging.&#x20;

You can toggle it ON or OFF based on your needs.

#### **Use Kerberos For Password Authentication**

This toggle button, when activated (toggled ON), utilizes the Kerberos login module to authenticate username/password against the Kerberos server instead of authenticating against the LDAP server with Directory Service API.

When deactivated (toggled OFF), the Kerberos login module is not used.

You can adjust this setting according to your requirements by toggling it ON or OFF.

### **Cache settings**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F9tcbv31SKqe53edYMVS4%2F75.png?alt=media&#x26;token=ad9419b8-bd77-4a24-8385-61f5e6fdfb85" alt=""><figcaption></figcaption></figure>

#### **Cache Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FX0HfUMTSprMh6rgt5ebI%2F76.png?alt=media&#x26;token=f55ff5b5-3ac2-460b-bef3-e27c707abd68" alt=""><figcaption></figcaption></figure>

This is the cache policy for this storage provider, which can have the following values:

* Default: Indicates whatever the default settings are for the global cache.
* Evict\_Daily: Specifies the time of day every day that the cache will be invalidated.
* Evict\_Weekly: Indicates the day of the week and time the cache will be invalidated.
* Max\_Lifespan: Refers to the time in milliseconds that will be the lifespan of a cache entry.
* No\_Cache: Indicates that no cache invalidation is required.

You can choose the most suitable option based on your needs.

### **Advanced settings**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FtcfudDLdFYkTH7H12Mq0%2F77.png?alt=media&#x26;token=a6c7e052-82d8-4743-b8c7-eebba0493eaa" alt=""><figcaption></figcaption></figure>

#### **Enable the LDAPv3 Password Modify Extended Operation**

This toggle button, when activated (toggled ON), enables the use of the LDAPv3 Password Modify Extended Operation (RFC-3062). The Password Modify Extended operation typically requires that LDAP users already have passwords in the LDAP server.&#x20;

When deactivated (toggled OFF), the Password Modify Extended Operation cannot be used.&#x20;

You can adjust it according to your needs by toggling it ON or OFF.

#### **Validate Password Policy**

This toggle button, when activated (toggled ON), indicates that ZTrust should validate the password with the realm password policy before updating the LDAP mapped user.&#x20;

When deactivated (toggled OFF), the ZTrust Password Policy would not be applied, meaning that the password will be updated on the LDAP Server unless the LDAP Server itself has some password policy rules.&#x20;

You can adjust it according to your needs by toggling it ON or OFF.

#### **Trust Email**

This toggle button, when activated (toggled ON), indicates that the email provided by this provider is not verified, even if verification is enabled for the realm.

When deactivated (toggled OFF), the provided email needs to be verified.

You can adjust it according to your requirements by toggling it ON or OFF.

#### **Save**

After making some changes, if you want to apply those changes, click on Save to implement those changes.

#### **Cancel**

If you decide not to apply the changes, click on Cancel to discard them.

\
