Containerized Keycloak development environment, using Docker, with:

• Active Directory (Samba)
• Keycloak
• Oracle Database

To spin up the Docker containers for all services mentioned above, run:

docker-compose -p keycloak-dev up -d

You can also use DC='mycompany',DC=com as the Base DN, but beware that it will make overall usage of LDAP Admin and AD syncs a lot slower.

By default, Samba requires a secure connection in order to allow simple (i.e. authenticated) binds. This means that for a system to be able to perform LDAP queries, LDAPS must be enabled.

To avoid the hassle of re-generating a self-signed certificate with the correct alt name entry and adding its CA to every container / host that interacts with it, include the following lines to /var/lib/samba/private/smb.conf and restart the container:

References:

• [Samba] Allow unencrypted TLS LDAP query
• ldap server require strong auth (G)

# Global parameters
[global]
	dns forwarder = 127.0.0.11
	netbios name = MYCOMPANY
	realm = MYCOMPANY.COM
	server role = active directory domain controller
	workgroup = DEV-AD
	idmap_ldb:use rfc2307 = yes
 
    client ldap sasl wrapping = sign
    ldap server require strong auth = no

[sysvol]
	path = /var/lib/samba/sysvol
	read only = No

[netlogon]
	path = /var/lib/samba/sysvol/mycompany.com/scripts
	read only = No

Create a new connection, using the following configurations:

Navigate to User federation >> LDAP and use the following configurations:

For more information regarding LDAP integration in Keycloak, read the following resources:

• Server Administration Guide - LDAP
• Configuring Keycloak for active directory and LDAP integration

• DBeaver