Skip to search

GroupMapper

ldap.keycloak.crossplane.io / v1alpha1

apiVersion: ldap.keycloak.crossplane.io/v1alpha1 kind: GroupMapper metadata: name: example
View raw schema
apiVersion string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata object
spec object required
GroupMapperSpec defines the desired state of GroupMapper
deletionPolicy string
DeletionPolicy specifies what will happen to the underlying external when this managed resource is deleted - either "Delete" or "Orphan" the external resource. This field is planned to be deprecated in favor of the ManagementPolicies field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
enum: Orphan, Delete
forProvider object required
dropNonExistingGroupsDuringSync boolean
When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.
groupNameLdapAttribute string
The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
groupObjectClasses []string
List of strings representing the object classes for the group. Must contain at least one.
groupsLdapFilter string
When specified, adds a custom filter to be used when querying for groups. Must start with ( and end with ).
groupsPath string
Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.
ignoreMissingGroups boolean
When true, missing groups in the hierarchy will be ignored.
ldapGroupsDn string
The LDAP DN where groups can be found.
ldapUserFederationId string
The ID of the LDAP user federation provider to attach this mapper to. The ldap user federation provider to attach this mapper to.
ldapUserFederationIdRef object
Reference to a UserFederation in ldap to populate ldapUserFederationId.
name string required
Name of the referenced object.
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
ldapUserFederationIdSelector object
Selector for a UserFederation in ldap to populate ldapUserFederationId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
mappedGroupAttributes []string
Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
memberofLdapAttribute string
Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
membershipAttributeType string
Can be one of DN or UID. Defaults to DN.
membershipLdapAttribute string
The name of the LDAP attribute that is used for membership mappings.
membershipUserLdapAttribute string
The name of the LDAP attribute on a user that is used for membership mappings.
mode string
Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
name string
Display name of this mapper when displayed in the console. Display name of the mapper when displayed in the console.
preserveGroupInheritance boolean
When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
realmId string
The realm that this LDAP mapper will exist in. The realm in which the ldap user federation provider exists.
realmIdRef object
Reference to a Realm in realm to populate realmId.
name string required
Name of the referenced object.
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
realmIdSelector object
Selector for a Realm in realm to populate realmId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
userRolesRetrieveStrategy string
Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
initProvider object
THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.
dropNonExistingGroupsDuringSync boolean
When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.
groupNameLdapAttribute string
The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
groupObjectClasses []string
List of strings representing the object classes for the group. Must contain at least one.
groupsLdapFilter string
When specified, adds a custom filter to be used when querying for groups. Must start with ( and end with ).
groupsPath string
Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.
ignoreMissingGroups boolean
When true, missing groups in the hierarchy will be ignored.
ldapGroupsDn string
The LDAP DN where groups can be found.
ldapUserFederationId string
The ID of the LDAP user federation provider to attach this mapper to. The ldap user federation provider to attach this mapper to.
ldapUserFederationIdRef object
Reference to a UserFederation in ldap to populate ldapUserFederationId.
name string required
Name of the referenced object.
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
ldapUserFederationIdSelector object
Selector for a UserFederation in ldap to populate ldapUserFederationId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
mappedGroupAttributes []string
Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
memberofLdapAttribute string
Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
membershipAttributeType string
Can be one of DN or UID. Defaults to DN.
membershipLdapAttribute string
The name of the LDAP attribute that is used for membership mappings.
membershipUserLdapAttribute string
The name of the LDAP attribute on a user that is used for membership mappings.
mode string
Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
name string
Display name of this mapper when displayed in the console. Display name of the mapper when displayed in the console.
preserveGroupInheritance boolean
When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
realmId string
The realm that this LDAP mapper will exist in. The realm in which the ldap user federation provider exists.
realmIdRef object
Reference to a Realm in realm to populate realmId.
name string required
Name of the referenced object.
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
realmIdSelector object
Selector for a Realm in realm to populate realmId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
userRolesRetrieveStrategy string
Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
managementPolicies []string
THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
providerConfigRef object
ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.
name string required
Name of the referenced object.
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
writeConnectionSecretToRef object
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
name string required
Name of the secret.
namespace string required
Namespace of the secret.
status object
GroupMapperStatus defines the observed state of GroupMapper.
atProvider object
dropNonExistingGroupsDuringSync boolean
When true, groups that no longer exist within LDAP will be dropped in Keycloak during sync. Defaults to false.
groupNameLdapAttribute string
The name of the LDAP attribute that is used in group objects for the name and RDN of the group. Typically cn.
groupObjectClasses []string
List of strings representing the object classes for the group. Must contain at least one.
groupsLdapFilter string
When specified, adds a custom filter to be used when querying for groups. Must start with ( and end with ).
groupsPath string
Keycloak group path the LDAP groups are added to. For example if value /Applications/App1 is used, then LDAP groups will be available in Keycloak under group App1, which is the child of top level group Applications. The configured group path must already exist in Keycloak when creating this mapper.
id string
ignoreMissingGroups boolean
When true, missing groups in the hierarchy will be ignored.
ldapGroupsDn string
The LDAP DN where groups can be found.
ldapUserFederationId string
The ID of the LDAP user federation provider to attach this mapper to. The ldap user federation provider to attach this mapper to.
mappedGroupAttributes []string
Array of strings representing attributes on the LDAP group which will be mapped to attributes on the Keycloak group.
memberofLdapAttribute string
Specifies the name of the LDAP attribute on the LDAP user that contains the groups the user is a member of. Defaults to memberOf.
membershipAttributeType string
Can be one of DN or UID. Defaults to DN.
membershipLdapAttribute string
The name of the LDAP attribute that is used for membership mappings.
membershipUserLdapAttribute string
The name of the LDAP attribute on a user that is used for membership mappings.
mode string
Can be one of READ_ONLY, LDAP_ONLY or IMPORT. Defaults to READ_ONLY.
name string
Display name of this mapper when displayed in the console. Display name of the mapper when displayed in the console.
preserveGroupInheritance boolean
When true, group inheritance will be propagated from LDAP to Keycloak. When false, all LDAP groups will be propagated as top level groups within Keycloak.
realmId string
The realm that this LDAP mapper will exist in. The realm in which the ldap user federation provider exists.
userRolesRetrieveStrategy string
Can be one of LOAD_GROUPS_BY_MEMBER_ATTRIBUTE, GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE, or LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY. Defaults to LOAD_GROUPS_BY_MEMBER_ATTRIBUTE.
conditions []object
Conditions of the resource.
lastTransitionTime string required
LastTransitionTime is the last time this condition transitioned from one status to another.
format: date-time
message string
A Message containing details about this condition's last transition from one status to another, if any.
observedGeneration integer
ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format: int64
reason string required
A Reason for this condition's last transition from one status to another.
status string required
Status of this condition; is it currently True, False, or Unknown?
type string required
Type of this condition. At most one of each condition type may apply to a resource at any point in time.
observedGeneration integer
ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention.
format: int64

No matches. Try .spec.deletionPolicy for an exact path