[RHDHBUGS-2481]: Add LDAP UUID sign-in resolver setup instructions#2042
Open
themr0c wants to merge 10 commits intoredhat-developer:mainfrom
Open
[RHDHBUGS-2481]: Add LDAP UUID sign-in resolver setup instructions#2042themr0c wants to merge 10 commits intoredhat-developer:mainfrom
themr0c wants to merge 10 commits intoredhat-developer:mainfrom
Conversation
Add procedure for configuring the oidcLdapUuidMatchingAnnotation resolver when using Keycloak with LDAP user federation. Covers Keycloak client scope setup and RHDH resolver configuration. Also add the resolver to the Keycloak resolver reference list. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
themr0c
added
Peer review needed 📖
Technical review needed 🔩
Collaborator
Content Quality Assessment ResultsCQA Report
SummaryChecks: 19 total, 19 pass, 0 fail Automated CQA check run on the entire repository — 2026-04-15 18:26:32 UTC |
Collaborator
|
Updated preview: https://redhat-developer.github.io/red-hat-developers-documentation-rhdh/pr-2042/ @ 4/15/2026, 6:33:54 PM |
|
JessicaJHee
suggested changes
Apr 15, 2026
| = Configure the LDAP UUID sign-in resolver for {rhbk-brand-name} | ||
|
|
||
| [role="_abstract"] | ||
| When you use {rhbk-brand-name} with LDAP user federation, you can configure the `oidcLdapUuidMatchingAnnotation` sign-in resolver to match users by their immutable LDAP UUID. |
Member
There was a problem hiding this comment.
Suggested change
| When you use {rhbk-brand-name} with LDAP user federation, you can configure the `oidcLdapUuidMatchingAnnotation` sign-in resolver to match users by their immutable LDAP UUID. | |
| When you use {rhbk-brand-name} with LDAP user federation, configure the `oidcLdapUuidMatchingAnnotation` sign-in resolver to match users by their immutable LDAP UUID for secure user resolution. |
The idea is to make it clear that for production environments, we should recommend setting up this resolver for best security practices.
| . Go to *Clients* > your {product} client > *Client scopes*. | ||
| Click *Add client scope* and add `ldap_uuid` as a *Default* scope. | ||
|
|
||
| . Add the `oidcLdapUuidMatchingAnnotation` resolver to your `{my-app-config-file}` file: |
Member
There was a problem hiding this comment.
This snippet is not mandatory. If ldapUuidKey is not configured, it'll default to ldap_uuid
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IMPORTANT: Do Not Merge - To be merged by Docs Team Only
Version(s): 1.8+
Issue: https://issues.redhat.com/browse/RHDHBUGS-2481
Preview: https://redhat-developer.github.io/red-hat-developers-documentation-rhdh/pr-2042/control-access_authentication-in-rhdh/
Summary
proc-configure-the-ldap-uuid-sign-in-resolver-for-rhbk.adocdocumenting how to set up theoidcLdapUuidMatchingAnnotationresolver when using Keycloak with LDAP user federationoidcLdapUuidMatchingAnnotationto the Keycloak resolver reference list with xref to the new procedureassembly-enable-authentication-with-rhbk.adocThe procedure covers Keycloak client scope setup (custom
ldap_uuidscope with User Attribute mapper) and RHDH resolver configuration (ldapUuidKeyparameter).Source material: redhat-developer/rhdh#2937, redhat-developer/rhdh#2980
🤖 Generated with Claude Code
Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com