Skip to content

Adding quickstarts for ppolicy for LDAP servers - #790

Merged
ahus1 merged 2 commits into
keycloak:mainfrom
ahus1:is-52400-ldap-quickstarts
Sep 11, 2026
Merged

Adding quickstarts for ppolicy for LDAP servers#790
ahus1 merged 2 commits into
keycloak:mainfrom
ahus1:is-52400-ldap-quickstarts

Conversation

@ahus1

@ahus1 ahus1 commented Sep 9, 2026

Copy link
Copy Markdown
Member

Related to keycloak/keycloak#52400 and the connected pull request.

Related to keycloak/keycloak#52400

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
@ahus1 ahus1 self-assigned this Sep 9, 2026
@ahus1
ahus1 requested a review from ruchikajha95 September 9, 2026 10:38
@ahus1

ahus1 commented Sep 9, 2026

Copy link
Copy Markdown
Member Author

@ruchikajha95 - I needed to prepare this to test a LDAP issue. As it could be handy in the future and for users, I added it as a quickstart.

Please review it when you have the time. Happy to join a 1:1 session on this one.

@ruchikajha95

Copy link
Copy Markdown
Contributor

Thank you @ahus1 for taking the time to discuss this PR 1-1. The context was very helpful, and I agree that having this framework in place will be valuable whenever we need to update policies in the future. I would be requesting some changes on this PR as discussed :

  1. Both setup files (389ds-ppolicy and openldap-ppolicy) try to use the same port (389).
    If a user tries to start both at the same time, the second one will crash because port 389 is already taken.
    Worth adding a note to the READMEs (or picking a different host port for one
    of the setups, e.g., 3389:3389 for 389ds) so users don't have to debug this.

  2. 389ds README: clarify internal vs. external port

  3. set-config-pw.ldif stores config password in cleartext

The file openldap-ppolicy/set-config-pw.ldif contains olcRootPW: config in plaintext. While acceptable for a test setup (and the README warns about this), CAn we consider using a hashed password ({SSHA}...) for slightly better
practice in example code that others may copy.

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
@ahus1

ahus1 commented Sep 11, 2026

Copy link
Copy Markdown
Member Author

@ruchikajha95 - I've addressed your comments as follows:

  • The two quickstarts now use distinct ports
  • The readmes just name the port, and as they are distinct, there is IMHO no need to talk about that.
  • For the quickstart to be more accessible, I'd like to keep it in plain text. Instead, I've updated the file to state that in a production environment the password should be hashed.

@ahus1
ahus1 merged commit d011404 into keycloak:main Sep 11, 2026
20 of 21 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants