Configuring IBM Optim Data Privacy to use an LDAP provider

Edit online

To enable IBM® Optim Data Privacy to use an LDAP provider for authentication, you must configure Keycloak to work with LDAP.

Keycloak normally maps the user name, email, first name, and last name of each user account, but you can configure additional mappings such as LDAP. The Keycloak LDAP provider supports password validation by using LDAP protocols, and also supports storage, edit, and synchronization modes.

Configuring Keycloak for LDAP

To configure Keycloak to use LDAP in your IBM Optim Data Privacy deployment:
  1. Navigate to the Keycloak administrator page and log in as the Keycloak administrator. The URL and administrator details are defined in the system's .env configuration file.
  2. Ensure that the correct Keycloak realm is selected.
  3. From the Manage menu, choose User federation, then click Add LDAP providers.
  4. On the LDAP provider configuration page, provide the required connection and authentication settings for your LDAP server. For examples, see Example LDAP provider settings. For descriptions of the settings, see the Keycloak documentation.
  5. Test the connection.
  6. Configure LDAP search and update settings. For examples, see Example LDAP provider settings. For descriptions of the settings, see the Keycloak documentation.
  7. Save your LDAP provider configuration.
  8. Synchronize the LDAP users to Keycloak.
    • From the Manage menu, choose User federation, then select your LDAP provider.
    • From the Action menu, click Sync all users.

Example LDAP provider settings

The following LDAP configuration settings are for a sample LDAP provider setup. These settings are provided as examples only. Replace these values with ones that are relevant for your LDAP server.
Connection and authentication settings
The following connection and authentication settings are provided as examples:
  • UI display name: ldap-pe
  • Vendor: Tivoli
  • Connection URL: ldap://mouse1.example.com:389
  • Bind type: simple
  • Bind DN: cn=admin,dc=ibm,dc=org
  • Bind credentials: 'provide creds'
LDAP search and update settings
The following search and update settings are provided as examples:
  • Edit mode: READ_ONLY
  • Users DN: ou=dmc,dc=ibm,dc=org (example LDAP users and parent of LDAP users)
  • Username LDAP attribute: cn
  • RDN LDAP attribute: cn
  • UUID LDAP attribute: cn
  • User object classes: inetOrgPerson,posixAccount,top
  • Search scope: Subtree