52.7. Enabling an IdM user to authenticate via an external IdP

Prerequisites

• You have created a reference to an external IdP in IdM. See Creating a reference to an external identity provider.

Procedure

• Modify the IdM user entry to associate an IdP reference with the user account:

  [root@server ~]# ipa user-mod idm-user-with-external-idp \
                 --idp my-keycloak-idp \
                 --idp-user-id idm-user-with-external-idp@idm.example.com \
                 --user-auth-type=idp
  ---------------------------------
  Modified user "idm-user-with-external-idp"
  ---------------------------------
    User login: idm-user-with-external-idp
    First name: Test
    Last name: User1
    Home directory: /home/idm-user-with-external-idp
    Login shell: /bin/sh
    Principal name: idm-user-with-external-idp@idm.example.com
    Principal alias: idm-user-with-external-idp@idm.example.com
    Email address: idm-user-with-external-idp@idm.example.com
    UID: 35000003
    GID: 35000003
    User authentication types: idp
    External IdP configuration: keycloak
    External IdP user identifier: idm-user-with-external-idp@idm.example.com
    Account disabled: False
    Password: False
    Member of groups: ipausers
    Kerberos keys available: False

Verification

• Verify that the output of the ipa user-show command for that user displays references to the IdP:

  [root@server ~]# ipa user-show idm-user-with-external-idp
    User login: idm-user-with-external-idp
    First name: Test
    Last name: User1
    Home directory: /home/idm-user-with-external-idp
    Login shell: /bin/sh
    Principal name: idm-user-with-external-idp@idm.example.com
    Principal alias: idm-user-with-external-idp@idm.example.com
    Email address: idm-user-with-external-idp@idm.example.com
    ID: 35000003
    GID: 35000003
    User authentication types: idp
    External IdP configuration: keycloak
    External IdP user identifier: idm-user-with-external-idp@idm.example.com
    Account disabled: False
    Password: False
    Member of groups: ipausers
    Kerberos keys available: False