Keycloak OpenLDAP

Option A - Azure Portal. Search the Azure Marketplace for "Keycloak with OpenLDAP Directory SecureAnyCloud" and select the offer. Choose Standard_B2s, your SSH key and your network, then create the VM. Open inbound ports 22 and 8080, and open 389 and 636 only to your VNet.

Option B - Azure CLI. Run:

az vm image terms accept --urn sac1647283583153:keycloak-openldap:default:latest
az vm create \
  --resource-group my-rg \
  --name keycloak-ldap-vm \
  --image sac1647283583153:keycloak-openldap:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub

Connect to the VM as azureuser:

ssh azureuser@<vm-ip>

First boot takes a couple of minutes. The image rotates every credential, regenerates the LDAP TLS certificate, bootstraps the Keycloak admin, wires the LDAP federation and verifies a federated login. It then writes the credentials file.

Read the credentials file with sudo:

sudo cat /root/keycloak-openldap-credentials.txt

The file (mode 0600, root only) holds the three per-VM secrets generated on first boot:

• KEYCLOAK_ADMIN_PASSWORD: the password for the console user SecureAnyCloud.
• OPENLDAP_ADMIN_PASSWORD: the password for the bind DN cn=admin,dc=example,dc=com.
• DEMO_USER_PASSWORD: the password for the LDAP demo user that signs in through Keycloak.

Confirm that slapd and Keycloak are running and check their versions:

sudo systemctl status slapd --no-pager | head -5 sudo systemctl status keycloak --no-pager | head -5 sudo /opt/keycloak/bin/kc.sh --version 2>&1 | head -1 dpkg-query -W -f='slapd ${Version}\n' slapd

Expected output:

● slapd.service - LSB: OpenLDAP standalone server (Lightweight Directory Access Protocol) Active: active (running) ● keycloak.service - Keycloak 26 Identity & Access Management (sac, OpenLDAP-federated) Active: active (running) Keycloak 26.7.1 slapd 2.6.10+dfsg-0ubuntu0.24.04.1

Bind as the directory administrator and list the seeded entries:

LDAP_PW=$(sudo grep -m1 '^OPENLDAP_ADMIN_PASSWORD=' /root/keycloak-openldap-credentials.txt | cut -d= -f2-) ldapwhoami -x -H ldap://127.0.0.1 -D 'cn=admin,dc=example,dc=com' -w "$LDAP_PW" ldapsearch -x -LLL -H ldap://127.0.0.1 -D 'cn=admin,dc=example,dc=com' -w "$LDAP_PW" \
  -b 'dc=example,dc=com' '(objectclass=*)' dn

Expected output:

dn:cn=admin,dc=example,dc=com dn: dc=example,dc=com dn: ou=people,dc=example,dc=com dn: ou=groups,dc=example,dc=com dn: uid=demo,ou=people,dc=example,dc=com

The image serves LDAP over TLS on port 636 with a certificate regenerated for this VM at first boot. Bind over LDAPS:

LDAP_PW=$(sudo grep -m1 '^OPENLDAP_ADMIN_PASSWORD=' /root/keycloak-openldap-credentials.txt | cut -d= -f2-) LDAPTLS_REQCERT=never ldapwhoami -x -H ldaps://127.0.0.1:636 -D 'cn=admin,dc=example,dc=com' -w "$LDAP_PW"

Expected output:

dn:cn=admin,dc=example,dc=com

For production, replace the self-signed pair at /etc/ldap/certs/ldap.crt and /etc/ldap/certs/ldap.key with a CA-signed certificate, then restart slapd.

Realm SecureAnyCloud federates its users from the local directory. Confirm the realm is live, then verify the end-to-end path by obtaining an OpenID Connect token for the LDAP-stored demo user:

curl -sf http://127.0.0.1:8080/realms/sac/.well-known/openid-configuration | head -c 200; echo
DEMO_PW=$(sudo grep -m1 '^DEMO_USER_PASSWORD=' /root/keycloak-openldap-credentials.txt | cut -d= -f2-)
curl -sf -X POST http://127.0.0.1:8080/realms/sac/protocol/openid-connect/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d "grant_type=password&client_id=admin-cli&username=demo&password=${DEMO_PW}" \
  | grep -o '"token_type":"Bearer"'

Expected output:

{"issuer":"http://127.0.0.1:8080/realms/sac","authorization_endpoint":"http://127.0.0.1:8080/realms/sac/protocol/openid-connect/auth", ... "token_type":"Bearer"

The password you used is stored only in OpenLDAP. Keycloak validated it by binding to the directory. The directory stays the single source of truth, and Keycloak issues the tokens.

Browse to http://<vm-ip>:8080/. Keycloak 26 opens the admin console sign-in form directly, with no separate welcome page. Sign in as SecureAnyCloud with KEYCLOAK_ADMIN_PASSWORD from Step 3.

After you sign in, you land on the master realm console. Keycloak flags the first-boot admin as a temporary account. As a hardening step, create your own permanent administrator and delete SecureAnyCloud.

Open Manage realms, switch to the SecureAnyCloud realm, then open User federation. The openldap provider is already configured and enabled against the local directory:

• Connection: ldap://127.0.0.1:389
• Users DN: ou=people,dc=example,dc=com
• Bind DN: cn=admin,dc=example,dc=com
• Edit mode: WRITABLE, with registration sync, so users created in Keycloak are written back to LDAP

Open Users in realm SecureAnyCloud. Because the realm has a federated provider, the list starts empty. Search for * (or a username), as the console suggests.

The demo user is returned with its name and email attributes mapped from LDAP. It lives in OpenLDAP and was imported by the first-boot full sync. Any user you add under ou=people appears here after a sync, and any user you create here is written into the directory.