Keycloak LDAP Integration

// federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java

public class LDAPStorageProvider implements
        UserStorageProvider,           // Base storage provider
        CredentialInputValidator,      // Password validation
        CredentialInputUpdater,        // Password updates
        CredentialAuthentication,      // Kerberos/SPNEGO auth
        UserLookupProvider,            // User lookup by ID/username/email
        UserRegistrationProvider,      // User registration
        UserQueryMethodsProvider,      // User search
        ImportedUserValidation,        // Validate imported users
        UserProfileDecorator {         // Customize user profile

    protected LDAPStorageProviderFactory factory;
    protected KeycloakSession session;
    protected UserStorageProviderModel model;
    protected LDAPIdentityStore ldapIdentityStore;
    protected EditMode editMode;
    protected LDAPProviderKerberosConfig kerberosConfig;
    protected LDAPStorageMapperManager mapperManager;
    protected LDAPStorageUserManager userManager;
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java

public class LDAPStorageProviderFactory implements
        UserStorageProviderFactory<ldapstorageprovider>,
        ImportSynchronization {

    // Sync users from LDAP to Keycloak
    @Override
    public SynchronizationResult sync(KeycloakSessionFactory sessionFactory,
                                       String realmId,
                                       UserStorageProviderModel model) {
        // Full sync - imports all LDAP users
    }

    @Override
    public SynchronizationResult syncSince(Date lastSync,
                                            KeycloakSessionFactory sessionFactory,
                                            String realmId,
                                            UserStorageProviderModel model) {
        // Changed users sync - imports users modified since lastSync
    }
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java

public class LDAPConfig {
    public static final String DEFAULT_CONNECTION_TIMEOUT = "5000";

    // Connection URL (ldap:// or ldaps://)
    public String getConnectionUrl() {
        return config.getFirst(LDAPConstants.CONNECTION_URL);
    }

    // Authentication type (simple, none)
    public String getAuthType() {
        String value = config.getFirst(LDAPConstants.AUTH_TYPE);
        return value == null ? LDAPConstants.AUTH_TYPE_SIMPLE : value;
    }

    // Bind DN for admin connection
    public String getBindDN() {
        return config.getFirst(LDAPConstants.BIND_DN);
    }

    // Users search DN
    public String getUsersDn() {
        return config.getFirst(LDAPConstants.USERS_DN);
    }

    // User object classes
    public Collection<string> getUserObjectClasses() {
        String objClassesCfg = config.getFirst(LDAPConstants.USER_OBJECT_CLASSES);
        String objClassesStr = (objClassesCfg != null &amp;&amp; objClassesCfg.length() &gt; 0)
            ? objClassesCfg.trim()
            : "inetOrgPerson,organizationalPerson";
        // Parse and return as Set
    }

    // Edit mode
    public EditMode getEditMode() {
        String editModeString = config.getFirst(LDAPConstants.EDIT_MODE);
        return editModeString == null
            ? EditMode.READ_ONLY
            : EditMode.valueOf(editModeString);
    }

    // Vendor-specific settings
    public boolean isActiveDirectory() {
        String vendor = getVendor();
        return vendor != null &amp;&amp; vendor.equals(LDAPConstants.VENDOR_ACTIVE_DIRECTORY);
    }
}

public String getUsersDn() {
    String str = config.getFirst(LDAPConstants.USERS_DN);
    return str;
}

public String getUsernameLdapAttribute() {
    String str = config.getFirst(LDAPConstants.USERNAME_LDAP_ATTRIBUTE);
    return str;
}

Username LDAP attribute: cn

public String getRdnLdapAttribute() {
    String str = config.getFirst(LDAPConstants.RDN_LDAP_ATTRIBUTE);
    return str;
}

public String getUuidLDAPAttributeName() {
    String uuidAttrName = config.getFirst(LDAPConstants.UUID_LDAP_ATTRIBUTE);
    if (uuidAttrName == null) {
        // Vendor-specific default
        uuidAttrName = isActiveDirectory() ?
            LDAPConstants.OBJECT_GUID : LDAPConstants.ENTRY_UUID;
    }
    return uuidAttrName;
}

UUID LDAP attribute: objectGUID

public Collection<string> getUserObjectClasses() {
    String str = config.getFirst(LDAPConstants.USER_OBJECT_CLASSES);
    if (str == null || str.isEmpty()) {
        str = "inetOrgPerson, organizationalPerson";
    }
    return parseMultivaluedString(str);
}

User object classes: person, organizationalPerson, user

public String getCustomUserSearchFilter() {
    String str = config.getFirst(LDAPConstants.CUSTOM_USER_SEARCH_FILTER);
    return str;
}

public int getSearchScope() {
    String str = config.getFirst(LDAPConstants.SEARCH_SCOPE);
    if (str == null) {
        return SearchControls.SUBTREE_SCOPE;  // Default: 2
    }
    return Integer.parseInt(str);
}

public int getReadTimeout() {
    String str = config.getFirst(LDAPConstants.READ_TIMEOUT);
    if (str == null) {
        return 0;  // No timeout (default)
    }
    return Integer.parseInt(str);
}

public boolean isPagination() {
    String str = config.getFirst(LDAPConstants.PAGINATION);
    return str != null && Boolean.parseBoolean(str);
}

Pagination: On
Batch Size For Sync: 1000 (default)

public String getReferral() {
    String str = config.getFirst(LDAPConstants.REFERRAL);
    if (str == null) {
        return "ignore";  // Default
    }
    return str;
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/ReadonlyLDAPUserModelDelegate.java

public class ReadonlyLDAPUserModelDelegate extends UserModelDelegate {

    @Override
    public void setUsername(String username) {
        if (getUsername().equals(username)) {
            // Same value - allowed (idempotent)
            return;
        }
        throw new ReadOnlyException("User is read-only");
    }

    @Override
    public void setSingleAttribute(String name, String value) {
        if (value.equals(getFirstAttribute(name))) {
            return;
        }
        throw new ReadOnlyException("User is read-only");
    }
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPWritesOnlyUserModelDelegate.java

public class LDAPWritesOnlyUserModelDelegate extends UserModelDelegate {

    private final LDAPTransaction ldapTransaction;
    private final LDAPObject ldapObject;

    @Override
    public void setSingleAttribute(String name, String value) {
        // Track which attributes are updated
        ldapTransaction.addUpdatedAttribute(name);
        delegate.setSingleAttribute(name, value);
    }
}

// Transaction commits changes to LDAP
public class LDAPTransaction {

    @Override
    protected void commitImpl() {
        if (!updatedAttributes.isEmpty()) {
            // Commit changes to LDAP
            ldapIdentityStore.update(ldapObject);
        }
    }
}

// In LDAPStorageProvider.proxy()

if (model.isImportEnabled()) {
    // Import mode - store users in local DB
    return proxiedUser;
} else {
    // No import - use in-memory adapter
    return new InMemoryUserAdapter(session, realm, storageId);
}

// LDAPStorageProviderFactory.java

@Override
public SynchronizationResult sync(KeycloakSessionFactory sessionFactory,
                                   String realmId,
                                   UserStorageProviderModel model) {
    // Create LDAP query for all users
    try (LDAPQuery query = createQuery(ldapProvider, realm, model)) {
        SynchronizationResult result = new SynchronizationResult();

        // Process users in batches with pagination
        boolean hasNext = true;
        while (hasNext) {
            List<ldapobject> ldapUsers = query.getResultList();

            for (LDAPObject ldapUser : ldapUsers) {
                try {
                    importLdapUser(session, realm, ldapProvider, ldapUser, result);
                } catch (ModelException e) {
                    result.increaseFailed();
                }
            }

            hasNext = query.hasMorePages();
            if (hasNext) {
                query.nextPage();
            }
        }

        // Sync mapper-specific data (groups, roles)
        syncMappers(sessionFactory, realmId, model, result);

        return result;
    }
}

private void importLdapUser(KeycloakSession session, RealmModel realm,
                            LDAPStorageProvider ldapProvider,
                            LDAPObject ldapUser,
                            SynchronizationResult result) {
    String ldapId = ldapUser.getUuid();
    String username = LDAPUtils.getUsername(ldapUser, ldapProvider.getLdapIdentityStore().getConfig());

    // Check if user already exists
    UserModel existingUser = session.users().getUserByFederatedIdentity(realm,
        new FederatedIdentityModel(model.getId(), ldapId, username));

    if (existingUser == null) {
        // Import new user
        UserModel imported = ldapProvider.importUserFromLDAP(session, realm, ldapUser);
        result.increaseAdded();
    } else {
        // Update existing user
        ldapProvider.updateImportedUser(session, realm, existingUser, ldapUser);
        result.increaseUpdated();
    }
}

@Override
public SynchronizationResult syncSince(Date lastSync,
                                        KeycloakSessionFactory sessionFactory,
                                        String realmId,
                                        UserStorageProviderModel model) {
    // Add filter for users modified since lastSync
    LDAPQueryConditionsBuilder conditionsBuilder = new LDAPQueryConditionsBuilder();

    // Different attributes for different LDAP vendors
    String modifyTimestampAttr = ldapConfig.isActiveDirectory()
        ? "whenChanged"
        : "modifyTimestamp";

    Condition condition = conditionsBuilder.greaterThanOrEqual(
        modifyTimestampAttr,
        LDAPUtils.formatDate(lastSync)
    );

    query.addWhereCondition(condition);

    return syncImpl(sessionFactory, realmId, model, query);
}

public static final String IMPORT_ENABLED = "importEnabled";

public boolean isImportEnabled() {
    if (importEnabled == null) {
        importEnabled = Boolean.parseBoolean(
            getConfig().getFirstOrDefault(IMPORT_ENABLED, Boolean.TRUE.toString()));
    }
    return importEnabled;
}

// LDAPStorageProvider.addUser()
if (model.isImportEnabled()) {
    user = UserStoragePrivateUtil.userLocalStorage(session).addUser(realm, username);
    user.setFederationLink(model.getId());
} else {
    // In-memory only, no persistence
    user = new InMemoryUserAdapter(session, realm, storageId);
    user.setUsername(username);
}

public boolean synchronizeRegistrations() {
    return "true".equalsIgnoreCase(model.getConfig().getFirst(LDAPConstants.SYNC_REGISTRATIONS))
        && editMode == UserStorageProvider.EditMode.WRITABLE;
}

@Override
public UserModel addUser(RealmModel realm, String username) {
    if (!synchronizeRegistrations()) {
        return null;  // Don't handle registration
    }

    final UserModel user;
    if (model.isImportEnabled()) {
        user = UserStoragePrivateUtil.userLocalStorage(session).addUser(realm, username);
        user.setFederationLink(model.getId());
    } else {
        user = new InMemoryUserAdapter(session, realm, storageId);
        user.setUsername(username);
    }
    // ... create LDAP entry
}

public static final String BATCH_SIZE_FOR_SYNC = "batchSizeForSync";
public static final int DEFAULT_BATCH_SIZE_FOR_SYNC = 1000;

protected SynchronizationResult syncImpl(KeycloakSessionFactory sessionFactory,
                                          LDAPQuery userQuery,
                                          String realmId,
                                          ComponentModel fedModel) {
    SynchronizationResult syncResult = new SynchronizationResult();

    LDAPConfig ldapConfig = new LDAPConfig(fedModel.getConfig());
    boolean pagination = ldapConfig.isPagination();

    if (pagination) {
        int pageSize = ldapConfig.getBatchSizeForSync();  // Use batch size

        boolean nextPage = true;
        while (nextPage) {
            userQuery.setLimit(pageSize);
            List<ldapobject> users = userQuery.getResultList();
            nextPage = userQuery.getPaginationContext().hasNextPage();

            SynchronizationResult currentPageSync = importLdapUsers(..., users);
            syncResult.add(currentPageSync);
        }
    }
    return syncResult;
}

public static final String FULL_SYNC_PERIOD = "fullSyncPeriod";

public int getFullSyncPeriod() {
    if (fullSyncPeriod == null) {
        String val = getConfig().getFirst(FULL_SYNC_PERIOD);
        if (val == null) {
            fullSyncPeriod = -1;  // Disabled
        } else {
            fullSyncPeriod = Integer.valueOf(val);
        }
    }
    return fullSyncPeriod;
}

public static final String CHANGED_SYNC_PERIOD = "changedSyncPeriod";

public int getChangedSyncPeriod() {
    if (changedSyncPeriod == null) {
        String val = getConfig().getFirst(CHANGED_SYNC_PERIOD);
        if (val == null) {
            changedSyncPeriod = -1;  // Disabled
        } else {
            changedSyncPeriod = Integer.valueOf(val);
        }
    }
    return changedSyncPeriod;
}

@Override
public SynchronizationResult syncSince(Date lastSync,
                                        KeycloakSessionFactory sessionFactory,
                                        String realmId,
                                        UserStorageProviderModel model) {
    LDAPQueryConditionsBuilder conditionsBuilder = new LDAPQueryConditionsBuilder();

    // Filter: createTimestamp >= lastSync OR modifyTimestamp >= lastSync
    Condition createCondition = conditionsBuilder.greaterThanOrEqualTo(
        LDAPConstants.CREATE_TIMESTAMP, lastSync);
    Condition modifyCondition = conditionsBuilder.greaterThanOrEqualTo(
        LDAPConstants.MODIFY_TIMESTAMP, lastSync);
    Condition orCondition = conditionsBuilder.orCondition(createCondition, modifyCondition);

    userQuery.addWhereCondition(orCondition);
    return syncImpl(sessionFactory, userQuery, realmId, model);
}

public static final String ALLOW_KERBEROS_AUTHENTICATION = "allowKerberosAuthentication";

public boolean isAllowKerberosAuthentication() {
    return Boolean.valueOf(getConfig().getFirst(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION));
}

supportedCredentialTypes.add(PasswordCredentialModel.TYPE);
if (kerberosConfig.isAllowKerberosAuthentication()) {
    supportedCredentialTypes.add(UserCredentialModel.KERBEROS);
}

if (credential.getType().equals(UserCredentialModel.KERBEROS)) {
    if (kerberosConfig.isAllowKerberosAuthentication()) {
        SPNEGOAuthenticator spnegoAuthenticator = (SPNEGOAuthenticator)
            credential.getNote(KerberosConstants.AUTHENTICATED_SPNEGO_CONTEXT);

        if (spnegoAuthenticator == null) {
            String spnegoToken = credential.getChallengeResponse();
            spnegoAuthenticator = factory.createSPNEGOAuthenticator(spnegoToken, kerberosConfig);
            spnegoAuthenticator.authenticate();
        }
        // ... process authentication result
    }
}

public static final String USE_KERBEROS_FOR_PASSWORD_AUTHENTICATION = "useKerberosForPasswordAuthentication";

public boolean isUseKerberosForPasswordAuthentication() {
    return Boolean.valueOf(getConfig().getFirst(KerberosConstants.USE_KERBEROS_FOR_PASSWORD_AUTHENTICATION));
}

public boolean validPassword(RealmModel realm, UserModel user, String password) {
    if (kerberosConfig.isAllowKerberosAuthentication()
            && kerberosConfig.isUseKerberosForPasswordAuthentication()) {
        // Use Kerberos JAAS (Krb5LoginModule)
        KerberosUsernamePasswordAuthenticator authenticator =
            factory.createKerberosUsernamePasswordAuthenticator(kerberosConfig);

        String kerberosUsername = user.getFirstAttribute(KerberosConstants.KERBEROS_PRINCIPAL);
        // Fallback to username (backwards compatibility)
        if (kerberosUsername == null) kerberosUsername = user.getUsername();

        return authenticator.validUser(kerberosUsername, password);
    } else {
        // Use Naming LDAP API (LDAP bind)
        LDAPObject ldapUser = loadAndValidateUser(realm, user);
        ldapIdentityStore.validatePassword(ldapUser, password);
        return true;
    }
}

public static final String ALLOW_KERBEROS_AUTHENTICATION = "allowKerberosAuthentication";
public static final String KERBEROS_REALM = "kerberosRealm";
public static final String SERVER_PRINCIPAL = "serverPrincipal";
public static final String KEYTAB = "keyTab";
public static final String DEBUG = "debug";
public static final String KERBEROS_PRINCIPAL_ATTRIBUTE = "krbPrincipalAttribute";

// Vendor-specific Kerberos principal attributes
public static final String KERBEROS_PRINCIPAL_LDAP_ATTRIBUTE_KRB5_PRINCIPAL_NAME = "krb5PrincipalName";  // ApacheDS
public static final String KERBEROS_PRINCIPAL_LDAP_ATTRIBUTE_KRB_PRINCIPAL_NAME = "krbPrincipalName";   // FreeIPA
public static final String KERBEROS_PRINCIPAL_LDAP_ATTRIBUTE_USER_PRINCIPAL_NAME = "userPrincipalName"; // AD

if (kerberosConfig.isAllowKerberosAuthentication()
        && kerberosConfig.getKerberosPrincipalAttribute() != null) {
    String kerberosPrincipal = ldapUser.getAttributeAsString(
        kerberosConfig.getKerberosPrincipalAttribute());

    if (kerberosPrincipal != null) {
        KerberosPrincipal kerberosPrinc = new KerberosPrincipal(kerberosPrincipal);
        user.setSingleAttribute(KerberosConstants.KERBEROS_PRINCIPAL, kerberosPrinc.toString());
    }
}

public enum CachePolicy {
    NO_CACHE,
    DEFAULT,
    EVICT_DAILY,
    EVICT_WEEKLY,
    MAX_LIFESPAN
}

if (policy == null || policy == CachePolicy.DEFAULT) {
    lifespan = -1;  // Use global defaults
}

if (policy == CacheableStorageProviderModel.CachePolicy.NO_CACHE) {
    invalidate = true;  // Always invalidate = always fetch from LDAP
}

public static final String MAX_LIFESPAN = "maxLifespan";

public long getMaxLifespan() {
    if (maxLifespan < 0) {
        String str = getConfig().getFirst(MAX_LIFESPAN);
        if (str == null) return -1;
        maxLifespan = Long.valueOf(str);
    }
    return maxLifespan;
}

if (policy == CacheableStorageProviderModel.CachePolicy.MAX_LIFESPAN) {
    if (cached.getCacheTimestamp() + getMaxLifespan() < Time.currentTimeMillis()) {
        invalidate = true;
    }
}

public static final String EVICTION_HOUR = "evictionHour";
public static final String EVICTION_MINUTE = "evictionMinute";

public void setEvictionHour(int evictionHour) {
    if (evictionHour > 23 || evictionHour < 0)
        throw new IllegalArgumentException("Must be between 0 and 23");
    this.evictionHour = evictionHour;
    getConfig().putSingle(EVICTION_HOUR, Integer.toString(evictionHour));
}

public void setEvictionMinute(int evictionMinute) {
    if (evictionMinute > 59 || evictionMinute < 0)
        throw new IllegalArgumentException("Must be between 0 and 59");
    this.evictionMinute = evictionMinute;
    getConfig().putSingle(EVICTION_MINUTE, Integer.toString(evictionMinute));
}

public static long dailyEvictionBoundary(int hour, int minute) {
    Calendar cal = Calendar.getInstance();
    cal.setTimeInMillis(Time.currentTimeMillis());
    cal.set(Calendar.HOUR_OF_DAY, hour);
    cal.set(Calendar.MINUTE, minute);
    cal.set(Calendar.SECOND, 0);
    cal.set(Calendar.MILLISECOND, 0);

    if (cal.getTimeInMillis() > Time.currentTimeMillis()) {
        // if daily evict for today hasn't happened yet
        // set boundary to yesterday's time of eviction
        cal.add(Calendar.DAY_OF_YEAR, -1);
    }
    return cal.getTimeInMillis();
}

public static final String EVICTION_DAY = "evictionDay";

public void setEvictionDay(int evictionDay) {
    if (evictionDay > 7 || evictionDay < 1)
        throw new IllegalArgumentException("Must be between 1 and 7");
    this.evictionDay = evictionDay;
    getConfig().putSingle(EVICTION_DAY, Integer.toString(evictionDay));
}

public static long weeklyTimeout(int day, int hour, int minute) {
    Calendar cal = Calendar.getInstance();
    cal.setTimeInMillis(Time.currentTimeMillis());
    cal.set(Calendar.HOUR_OF_DAY, hour);
    cal.set(Calendar.MINUTE, minute);
    cal.set(Calendar.DAY_OF_WEEK, day);
    cal.set(Calendar.SECOND, 0);
    cal.set(Calendar.MILLISECOND, 0);

    if (cal.getTimeInMillis() < Time.currentTimeMillis()) {
        int oneWeek = (7 * 24 * 60 * 60 * 1000);
        cal.add(Calendar.MILLISECOND, oneWeek);
    }
    return cal.getTimeInMillis();
}

public boolean shouldInvalidate(CachedObject cached) {
    boolean invalidate = false;

    if (!isEnabled()) {
        invalidate = true;  // Provider disabled = invalidate all
    } else {
        CachePolicy policy = getCachePolicy();
        if (policy != null) {
            if (policy == CachePolicy.NO_CACHE) {
                invalidate = true;
            } else if (cached.getCacheTimestamp() < getCacheInvalidBefore()) {
                invalidate = true;  // Manual invalidation
            } else if (policy == CachePolicy.MAX_LIFESPAN) {
                if (cached.getCacheTimestamp() + getMaxLifespan() < Time.currentTimeMillis()) {
                    invalidate = true;
                }
            } else if (policy == CachePolicy.EVICT_DAILY) {
                long dailyBoundary = dailyEvictionBoundary(getEvictionHour(), getEvictionMinute());
                if (cached.getCacheTimestamp() <= dailyBoundary) {
                    invalidate = true;
                }
            } else if (policy == CachePolicy.EVICT_WEEKLY) {
                int oneWeek = 7 * 24 * 60 * 60 * 1000;
                long weeklyTimeout = weeklyTimeout(getEvictionDay(), getEvictionHour(), getEvictionMinute());
                long lastTimeout = weeklyTimeout - oneWeek;
                if (cached.getCacheTimestamp() <= lastTimeout) {
                    invalidate = true;
                }
            }
        }
    }
    return invalidate;
}

public static final String CACHE_INVALID_BEFORE = "cacheInvalidBefore";

public long getCacheInvalidBefore() {
    if (cacheInvalidBefore < 0) {
        String str = getConfig().getFirst(CACHE_INVALID_BEFORE);
        if (str == null) return -1;
        cacheInvalidBefore = Long.valueOf(str);
    }
    return cacheInvalidBefore;
}

public static final String USE_PASSWORD_MODIFY_EXTENDED_OP = "usePasswordModifyExtendedOp";

public boolean useExtendedPasswordModifyOp() {
    String value = config.getFirst(LDAPConstants.USE_PASSWORD_MODIFY_EXTENDED_OP);
    return Boolean.parseBoolean(value);
}

if (config.useExtendedPasswordModifyOp()) {
    // Use RFC 3062 Password Modify Extended Operation
    operationManager.passwordModifyExtended(user.getDn().getLdapName(), password, decorator);
} else {
    // Direct attribute modification
    ModificationItem[] mods = new ModificationItem[1];
    BasicAttribute mod0 = new BasicAttribute(LDAPConstants.USER_PASSWORD_ATTRIBUTE, password);
    mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod0);
    operationManager.modifyAttributes(user.getDn().getLdapName(), mods, decorator);
}

public void passwordModifyExtended(LdapName dn, String password, LDAPOperationDecorator decorator) {
    execute(context -> {
        PasswordModifyRequest modifyRequest = new PasswordModifyRequest(dn.toString(), null, password);
        return context.extendedOperation(modifyRequest);
    }, decorator);
}

// LDAPStorageProviderFactory.java:485-491
if (!activeDirectory && syncRegistrations && ldapConfig.useExtendedPasswordModifyOp()) {
    // Create mapper to set random "userPassword" on user creation
    // Otherwise users won't be able to register and login
    mapperModel = KeycloakModelUtils.createComponentModel(
        "random initial password",
        model.getId(),
        HardcodedLDAPAttributeMapperFactory.PROVIDER_ID,
        HardcodedLDAPAttributeMapper.LDAP_ATTRIBUTE_NAME, LDAPConstants.USER_PASSWORD_ATTRIBUTE,
        HardcodedLDAPAttributeMapper.LDAP_ATTRIBUTE_VALUE, HardcodedLDAPAttributeMapper.RANDOM_ATTRIBUTE_VALUE);
}

public static final String VALIDATE_PASSWORD_POLICY = "validatePasswordPolicy";

public boolean isValidatePasswordPolicy() {
    String validatePPolicy = config.getFirst(LDAPConstants.VALIDATE_PASSWORD_POLICY);
    return Boolean.parseBoolean(validatePPolicy);
}

if (ldapIdentityStore.getConfig().isValidatePasswordPolicy()) {
    PolicyError error = session.getProvider(PasswordPolicyManagerProvider.class)
        .validate(realm, user, password);
    if (error != null) {
        throw new ModelException(error.getMessage(), error.getParameters());
    }
}

// validatePasswordPolicy applicable only for WRITABLE mode
if (cfg.getEditMode() != UserStorageProvider.EditMode.WRITABLE) {
    if (cfg.isValidatePasswordPolicy()) {
        throw new ComponentValidationException("ldapErrorValidatePasswordPolicyAvailableForWritableOnly");
    }
}

public static final String TRUST_EMAIL = "trustEmail";

public boolean isTrustEmail() {
    String trustEmail = config.getFirst(LDAPConstants.TRUST_EMAIL);
    return Boolean.parseBoolean(trustEmail);
}

if (getLdapIdentityStore().getConfig().isTrustEmail()) {
    user.setEmailVerified(true);
}

public static final String CONNECTION_TRACE = "connectionTrace";
public static final String CONNECTION_TRACE_BER = "com.sun.jndi.ldap.trace.ber";

public boolean isConnectionTrace() {
    return Boolean.parseBoolean(config.getFirstOrDefault(
        LDAPConstants.CONNECTION_TRACE, Boolean.FALSE.toString()));
}

if (ldapConfig.isConnectionTrace()) {
    connProp.put(LDAPConstants.CONNECTION_TRACE_BER, System.err);
}

>>> BER:encode(BIND)
    dn: cn=admin,dc=example,dc=com
    version: 3
<<< BER:decode(BIND_RESPONSE)
    resultCode: success
>>> BER:encode(SEARCH)
    base: ou=People,dc=example,dc=com
    filter: (uid=john)
...

// federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/LDAPStorageMapper.java

public interface LDAPStorageMapper extends Provider {

    // Sync data from LDAP to Keycloak (e.g., during full sync)
    void syncDataFromFederationProviderToKeycloak(RealmModel realm);

    // Sync data from Keycloak to LDAP (e.g., during user update)
    void syncDataFromKeycloakToFederationProvider(RealmModel realm);

    // Called when user is imported from LDAP
    void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user,
                              RealmModel realm, boolean isCreate);

    // Called when user is registered in Keycloak and needs to be created in LDAP
    void onRegisterUserToLDAP(LDAPObject ldapUser, UserModel localUser,
                              RealmModel realm);

    // Wrap user model with mapper-specific behavior
    UserModel proxy(LDAPObject ldapUser, UserModel delegate,
                    RealmModel realm);

    // Modify LDAP query before execution
    void beforeLDAPQuery(LDAPQuery query);

    // Handle authentication failures
    boolean onAuthenticationFailure(LDAPObject ldapUser, UserModel user,
                                    AuthenticationException exception,
                                    RealmModel realm);
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/UserAttributeLDAPStorageMapper.java

public class UserAttributeLDAPStorageMapper extends AbstractLDAPStorageMapper {

    public static final String USER_MODEL_ATTRIBUTE = "user.model.attribute";
    public static final String LDAP_ATTRIBUTE = "ldap.attribute";
    public static final String READ_ONLY = "read.only";
    public static final String ALWAYS_READ_VALUE_FROM_LDAP = "always.read.value.from.ldap";
    public static final String IS_MANDATORY_IN_LDAP = "is.mandatory.in.ldap";
    public static final String IS_BINARY_ATTRIBUTE = "is.binary.attribute";
    public static final String ATTRIBUTE_DEFAULT_VALUE = "attribute.default.value";

    @Override
    public void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user,
                                      RealmModel realm, boolean isCreate) {
        String userModelAttr = mapperModel.get(USER_MODEL_ATTRIBUTE);
        String ldapAttr = mapperModel.get(LDAP_ATTRIBUTE);

        // Get value from LDAP
        Object ldapValue = ldapUser.getAttributeAsSet(ldapAttr);

        // Map to Keycloak user attribute
        if (ldapValue != null) {
            if (isBinaryAttribute()) {
                // Handle binary (e.g., certificate)
                user.setSingleAttribute(userModelAttr, Base64.encode(ldapValue));
            } else {
                user.setSingleAttribute(userModelAttr, ldapValue.toString());
            }
        }
    }

    @Override
    public void onRegisterUserToLDAP(LDAPObject ldapUser, UserModel localUser,
                                      RealmModel realm) {
        String userModelAttr = mapperModel.get(USER_MODEL_ATTRIBUTE);
        String ldapAttr = mapperModel.get(LDAP_ATTRIBUTE);

        // Get value from Keycloak user
        String value = localUser.getFirstAttribute(userModelAttr);

        // Set in LDAP object
        if (value != null) {
            ldapUser.setSingleAttribute(ldapAttr, value);
        } else if (isMandatory()) {
            // Use default value for mandatory attributes
            String defaultValue = mapperModel.get(ATTRIBUTE_DEFAULT_VALUE);
            ldapUser.setSingleAttribute(ldapAttr, defaultValue);
        }
    }
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/group/GroupLDAPStorageMapper.java

public class GroupLDAPStorageMapper extends AbstractLDAPStorageMapper
        implements LDAPStorageMapper {

    // Configuration properties
    public static final String GROUPS_DN = "groups.dn";
    public static final String GROUP_NAME_LDAP_ATTRIBUTE = "group.name.ldap.attribute";
    public static final String GROUP_OBJECT_CLASSES = "group.object.classes";
    public static final String MEMBERSHIP_LDAP_ATTRIBUTE = "membership.ldap.attribute";
    public static final String MEMBERSHIP_ATTRIBUTE_TYPE = "membership.attribute.type";
    public static final String GROUPS_LDAP_FILTER = "groups.ldap.filter";
    public static final String MODE = "mode";
    public static final String USER_ROLES_RETRIEVE_STRATEGY = "user.roles.retrieve.strategy";
    public static final String MAPPED_GROUP_ATTRIBUTES = "mapped.group.attributes";

    @Override
    public void syncDataFromFederationProviderToKeycloak(RealmModel realm) {
        // Query all LDAP groups
        try (LDAPQuery ldapQuery = createGroupQuery(false)) {
            List<ldapobject> ldapGroups = ldapQuery.getResultList();

            // Import each group to Keycloak
            for (LDAPObject ldapGroup : ldapGroups) {
                String groupName = getGroupName(ldapGroup);

                GroupModel kcGroup = realm.getGroupsStream()
                    .filter(g -&gt; g.getName().equals(groupName))
                    .findFirst()
                    .orElse(null);

                if (kcGroup == null) {
                    // Create new group
                    kcGroup = realm.createGroup(groupName);
                }

                // Sync group attributes
                syncGroupAttributes(ldapGroup, kcGroup);
            }
        }
    }

    @Override
    public void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user,
                                      RealmModel realm, boolean isCreate) {
        // Get user's group memberships from LDAP
        Set<ldapobject> ldapGroups = getLDAPGroupsOfUser(ldapUser);

        for (LDAPObject ldapGroup : ldapGroups) {
            String groupName = getGroupName(ldapGroup);
            GroupModel kcGroup = KeycloakModelUtils.findGroupByPath(realm, "/" + groupName);

            if (kcGroup != null) {
                user.joinGroup(kcGroup);
            }
        }
    }

    // Membership types
    public enum MembershipType {
        DN,      // Member attribute contains full DN
        UID,     // Member attribute contains UID
        EMAIL    // Member attribute contains email
    }

    // Mapper modes
    public enum Mode {
        LDAP_ONLY,   // Groups exist only in LDAP
        IMPORT,      // Import groups to Keycloak
        READ_ONLY    // Read-only sync
    }
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/membership/role/RoleLDAPStorageMapper.java

public class RoleLDAPStorageMapper extends AbstractLDAPStorageMapper {

    public static final String ROLES_DN = "roles.dn";
    public static final String ROLE_NAME_LDAP_ATTRIBUTE = "role.name.ldap.attribute";
    public static final String ROLE_OBJECT_CLASSES = "role.object.classes";
    public static final String MEMBERSHIP_LDAP_ATTRIBUTE = "membership.ldap.attribute";
    public static final String USE_REALM_ROLES_MAPPING = "use.realm.roles.mapping";
    public static final String CLIENT_ID = "client.id";

    @Override
    public void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user,
                                      RealmModel realm, boolean isCreate) {
        // Get user's role memberships from LDAP
        Set<ldapobject> ldapRoles = getLDAPRolesOfUser(ldapUser);

        for (LDAPObject ldapRole : ldapRoles) {
            String roleName = getRoleName(ldapRole);

            RoleModel role;
            if (useRealmRoles()) {
                role = realm.getRole(roleName);
            } else {
                ClientModel client = realm.getClientByClientId(getClientId());
                role = client.getRole(roleName);
            }

            if (role != null) {
                user.grantRole(role);
            }
        }
    }
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java

public class MSADUserAccountControlStorageMapper extends AbstractLDAPStorageMapper
        implements PasswordUpdateCallback {

    // AD userAccountControl flags
    public static final int ACCOUNT_DISABLED = 0x0002;
    public static final int LOCKOUT = 0x0010;
    public static final int PASSWORD_EXPIRED = 0x800000;
    public static final int NORMAL_ACCOUNT = 0x0200;
    public static final int DONT_EXPIRE_PASSWORD = 0x10000;

    @Override
    public void onImportUserFromLDAP(LDAPObject ldapUser, UserModel user,
                                      RealmModel realm, boolean isCreate) {
        String uacValue = ldapUser.getAttributeAsString("userAccountControl");

        if (uacValue != null) {
            int uac = Integer.parseInt(uacValue);

            // Check if account is disabled
            boolean disabled = (uac & ACCOUNT_DISABLED) != 0;
            user.setEnabled(!disabled);

            // Check if account is locked
            boolean locked = (uac & LOCKOUT) != 0;
            if (locked) {
                // Handle lockout
            }
        }
    }

    @Override
    public void passwordUpdated(UserModel user, LDAPObject ldapUser,
                                CredentialInput input) {
        // Clear password-related flags after successful password update
        String uacValue = ldapUser.getAttributeAsString("userAccountControl");
        int uac = Integer.parseInt(uacValue);

        // Remove LOCKOUT and PASSWORD_EXPIRED flags
        uac &= ~LOCKOUT;
        uac &= ~PASSWORD_EXPIRED;

        ldapUser.setSingleAttribute("userAccountControl", String.valueOf(uac));
    }
}

// LDAPStorageProvider.java

@Override
public boolean isValid(RealmModel realm, UserModel user, CredentialInput input) {
    if (!supportsCredentialType(input.getType())) {
        return false;
    }

    // Get LDAP user object
    LDAPObject ldapUser = loadAndValidateUser(realm, user);
    if (ldapUser == null) {
        return false;
    }

    String password = input.getChallengeResponse();

    try {
        // Attempt Kerberos authentication first (if configured)
        if (kerberosConfig.isEnabled()) {
            boolean kerberosAuth = validKerberosPassword(ldapUser, password);
            if (kerberosAuth) {
                return true;
            }
        }

        // Fall back to LDAP bind authentication
        return ldapIdentityStore.validatePassword(ldapUser, password);

    } catch (AuthenticationException e) {
        // Handle authentication failure through mappers
        boolean handled = handleAuthenticationFailure(ldapUser, user, e, realm);
        return false;
    }
}

// LDAPIdentityStore.java

public boolean validatePassword(LDAPObject user, String password) {
    String userDn = user.getDn().toString();

    try {
        // Create new LDAP context with user credentials
        LDAPContextManager ldapContextManager = LDAPContextManager.builder()
            .setConfig(config)
            .setBindDn(userDn)
            .setBindCredential(password)
            .build();

        // Attempt bind - throws AuthenticationException if invalid
        ldapContextManager.getLdapContext();
        return true;

    } catch (AuthenticationException e) {
        return false;
    }
}

// LDAPStorageProvider.java

@Override
public boolean updateCredential(RealmModel realm, UserModel user,
                                 CredentialInput input) {
    if (!supportsCredentialType(input.getType())) {
        return false;
    }

    if (editMode == EditMode.READ_ONLY) {
        throw new ReadOnlyException("Cannot update password in read-only mode");
    }

    LDAPObject ldapUser = loadAndValidateUser(realm, user);
    String password = input.getChallengeResponse();

    // Optional: Validate against Keycloak password policy
    if (config.isValidatePasswordPolicy()) {
        PolicyError error = session.getProvider(PasswordPolicyManagerProvider.class)
            .validate(realm, user, password);
        if (error != null) {
            throw new ModelException(error.getMessage());
        }
    }

    // Call mapper callbacks before password update
    LDAPOperationDecorator decorator = getOperationDecorator(ldapUser, user, input);

    try {
        // Update password in LDAP
        ldapIdentityStore.updatePassword(ldapUser, password, decorator);

        // Call mapper callbacks after success
        getPasswordUpdateCallbacks().forEach(cb ->
            cb.passwordUpdated(user, ldapUser, input));

        return true;

    } catch (ModelException e) {
        // Call mapper callbacks on failure
        getPasswordUpdateCallbacks().forEach(cb ->
            cb.passwordUpdateFailed(user, ldapUser, input, e));
        throw e;
    }
}

// LDAPStorageProvider.java

@Override
public CredentialValidationOutput authenticate(RealmModel realm,
                                                CredentialInput input) {
    if (!(input instanceof UserCredentialModel)) {
        return null;
    }

    if (kerberosConfig.isEnabled() &&
        input.getType().equals(KerberosConstants.KERBEROS_AUTHENTICATION)) {

        // SPNEGO token authentication
        String spnegoToken = input.getChallengeResponse();
        SPNEGOAuthenticator authenticator = factory.createSPNEGOAuthenticator(
            spnegoToken, kerberosConfig);

        authenticator.authenticate();

        if (authenticator.isAuthenticated()) {
            // Find or create user based on Kerberos principal
            String kerberosUserName = authenticator.getAuthenticatedUsername();
            UserModel user = findOrCreateKerberosUser(realm, kerberosUserName);

            return new CredentialValidationOutput(user, State.AUTHENTICATED,
                authenticator.getDelegationCredential());
        }
    }

    return null;
}

// federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java

public class LDAPContextManager implements AutoCloseable {

    private final LDAPConfig ldapConfig;
    private final KeycloakSession session;
    private LdapContext ldapContext;
    private StartTlsResponse tlsResponse;

    public LdapContext getLdapContext() throws NamingException {
        if (ldapContext == null) {
            ldapContext = createLdapContext();
        }
        return ldapContext;
    }

    private LdapContext createLdapContext() throws NamingException {
        Hashtable<object, object=""> env = new Hashtable&lt;&gt;();

        env.put(Context.INITIAL_CONTEXT_FACTORY, ldapConfig.getFactoryName());
        env.put(Context.PROVIDER_URL, ldapConfig.getConnectionUrl());
        env.put(Context.SECURITY_AUTHENTICATION, ldapConfig.getAuthType());

        // Connection pooling (disabled for StartTLS)
        String connectionPooling = ldapConfig.getConnectionPooling();
        if (connectionPooling != null) {
            env.put("com.sun.jndi.ldap.connect.pool", connectionPooling);
        }

        // Timeouts
        String connectionTimeout = ldapConfig.getConnectionTimeout();
        if (connectionTimeout != null) {
            env.put("com.sun.jndi.ldap.connect.timeout", connectionTimeout);
        }

        String readTimeout = ldapConfig.getReadTimeout();
        if (readTimeout != null) {
            env.put("com.sun.jndi.ldap.read.timeout", readTimeout);
        }

        // Bind credentials (from vault or direct)
        String bindDn = ldapConfig.getBindDN();
        String bindCredential = getBindCredential();

        if (bindDn != null) {
            env.put(Context.SECURITY_PRINCIPAL, bindDn);
            env.put(Context.SECURITY_CREDENTIALS, bindCredential);
        }

        LdapContext ctx = new InitialLdapContext(env, null);

        // StartTLS if configured
        if (ldapConfig.isStartTls()) {
            tlsResponse = (StartTlsResponse) ctx.extendedOperation(
                new StartTlsRequest());
            tlsResponse.negotiate();
        }

        return ctx;
    }

    @Override
    public void close() {
        if (tlsResponse != null) {
            try {
                tlsResponse.close();
            } catch (IOException e) {
                logger.warn("Error closing TLS", e);
            }
        }
        if (ldapContext != null) {
            try {
                ldapContext.close();
            } catch (NamingException e) {
                logger.warn("Error closing LDAP context", e);
            }
        }
    }
}

// LDAPStorageProviderFactory.java:308-318

@Override
public void init(Config.Scope config) {
    // Enable connection pooling for both plain (ldap://) and SSL (ldaps://) protocols
    if (System.getProperty("com.sun.jndi.ldap.connect.pool.protocol") == null) {
        System.setProperty("com.sun.jndi.ldap.connect.pool.protocol", "plain ssl");
    }
}

// LDAPContextManager.java:205-208

String connectionPooling = ldapConfig.getConnectionPooling();
if (connectionPooling != null) {
    env.put("com.sun.jndi.ldap.connect.pool", connectionPooling);
}

// LDAPConfig.java:139-144
public String getConnectionPooling() {
    if (isStartTls()) {
        return null;  // Automatically disable pooling when StartTLS is enabled
    } else {
        return config.getFirst(LDAPConstants.CONNECTION_POOLING);
    }
}

// LDAPStorageProviderFactory.java:280-283 - Validation at configuration time
if (cfg.isStartTls() && Boolean.parseBoolean(
        config.getConfig().getFirst(LDAPConstants.CONNECTION_POOLING))) {
    throw new ComponentValidationException("ldapErrorCantEnableStartTlsAndConnectionPooling");
}

// LDAPOperationManager.java:497-498
// Never use connection pool to prevent password caching
env.put("com.sun.jndi.ldap.connect.pool", "false");

Provider: ldap
Edit Mode: READ_ONLY
Vendor: Active Directory

Connection URL: ldap://ad.example.com:389
Bind DN: cn=admin,cn=users,dc=example,dc=com
Bind Credential: ********

Users DN: cn=users,dc=example,dc=com
Username LDAP attribute: sAMAccountName
RDN LDAP attribute: cn
UUID LDAP attribute: objectGUID
User Object Classes: person, organizationalPerson, user

Search Scope: Subtree
Pagination: On
Batch Size For Sync: 1000

# Get admin token
TOKEN=$(curl -s -X POST \
  "http://localhost:8080/realms/master/protocol/openid-connect/token" \
  -d "grant_type=password&client_id=admin-cli&username=admin&password=admin" \
  | jq -r '.access_token')

# Create LDAP federation provider
curl -X POST "http://localhost:8080/admin/realms/myrealm/components" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "ldap",
    "providerId": "ldap",
    "providerType": "org.keycloak.storage.UserStorageProvider",
    "config": {
      "editMode": ["READ_ONLY"],
      "vendor": ["ad"],
      "connectionUrl": ["ldap://ad.example.com:389"],
      "bindDn": ["cn=admin,cn=users,dc=example,dc=com"],
      "bindCredential": ["secret"],
      "usersDn": ["cn=users,dc=example,dc=com"],
      "usernameLDAPAttribute": ["sAMAccountName"],
      "rdnLDAPAttribute": ["cn"],
      "uuidLDAPAttribute": ["objectGUID"],
      "userObjectClasses": ["person, organizationalPerson, user"],
      "searchScope": ["2"],
      "pagination": ["true"],
      "batchSizeForSync": ["1000"],
      "importEnabled": ["true"],
      "syncRegistrations": ["false"]
    }
  }'

LDAP_ID="ldap-provider-id"

# Map department attribute
curl -X POST "http://localhost:8080/admin/realms/myrealm/components" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"department\",
    \"providerId\": \"user-attribute-ldap-mapper\",
    \"providerType\": \"org.keycloak.storage.ldap.mappers.LDAPStorageMapper\",
    \"parentId\": \"$LDAP_ID\",
    \"config\": {
      \"ldap.attribute\": [\"department\"],
      \"user.model.attribute\": [\"department\"],
      \"read.only\": [\"true\"],
      \"always.read.value.from.ldap\": [\"false\"],
      \"is.mandatory.in.ldap\": [\"false\"]
    }
  }"

# Map LDAP groups to Keycloak groups
curl -X POST "http://localhost:8080/admin/realms/myrealm/components" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"ldap-groups\",
    \"providerId\": \"group-ldap-mapper\",
    \"providerType\": \"org.keycloak.storage.ldap.mappers.LDAPStorageMapper\",
    \"parentId\": \"$LDAP_ID\",
    \"config\": {
      \"groups.dn\": [\"cn=groups,dc=example,dc=com\"],
      \"group.name.ldap.attribute\": [\"cn\"],
      \"group.object.classes\": [\"groupOfNames\"],
      \"membership.ldap.attribute\": [\"member\"],
      \"membership.attribute.type\": [\"DN\"],
      \"mode\": [\"READ_ONLY\"],
      \"user.roles.retrieve.strategy\": [\"LOAD_GROUPS_BY_MEMBER_ATTRIBUTE\"],
      \"drop.non.existing.groups.during.sync\": [\"false\"]
    }
  }"

# Full sync
curl -X POST "http://localhost:8080/admin/realms/myrealm/user-storage/$LDAP_ID/sync?action=triggerFullSync" \
  -H "Authorization: Bearer $TOKEN"

# Changed users sync
curl -X POST "http://localhost:8080/admin/realms/myrealm/user-storage/$LDAP_ID/sync?action=triggerChangedUsersSync" \
  -H "Authorization: Bearer $TOKEN"

curl -X POST "http://localhost:8080/admin/realms/myrealm/testLDAPConnection" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "testConnection",
    "connectionUrl": "ldap://ad.example.com:389",
    "bindDn": "cn=admin,cn=users,dc=example,dc=com",
    "bindCredential": "secret",
    "useTruststoreSpi": "ldapsOnly",
    "connectionTimeout": "5000"
  }'

# Test authentication
curl -X POST "http://localhost:8080/admin/realms/myrealm/testLDAPConnection" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "testAuthentication",
    "connectionUrl": "ldap://ad.example.com:389",
    "bindDn": "cn=admin,cn=users,dc=example,dc=com",
    "bindCredential": "secret",
    "useTruststoreSpi": "ldapsOnly"
  }'

# Start Keycloak with debug logging
bin/kc.sh start-dev --log-level=org.keycloak.storage.ldap:debug

<logger category="org.keycloak.storage.ldap">
<level name="DEBUG"></level>
</logger>

// Test connection programmatically
LDAPContextManager manager = LDAPContextManager.builder()
    .setConfig(ldapConfig)
    .build();

try {
    LdapContext ctx = manager.getLdapContext();
    // Connection successful
    Attributes attrs = ctx.getAttributes("");
    // Check root DSE
} catch (NamingException e) {
    // Connection failed
    logger.error("LDAP connection failed", e);
}

Connection Pooling: true

Pagination: true
Batch Size For Sync: 1000

Connection Timeout: 5000
Read Timeout: 30000

# Option 1: LDAPS
Connection URL: ldaps://ldap.example.com:636

# Option 2: StartTLS
Connection URL: ldap://ldap.example.com:389
Start TLS: true

Custom User LDAP Filter: (&(objectClass=user)(!(objectClass=computer))(enabled=TRUE))

Periodic Full Sync: false
Full Sync Period: -1
Periodic Changed Users Sync: true
Changed Users Sync Period: 86400