Issue with Multiple User Federation Providers
search cancel

Issue with Multiple User Federation Providers

book

Article ID: 454508

calendar_today

Updated On:

Products

Service Virtualization

Issue/Introduction

When moving from LDAP to LDAPS in DevTest, users may experience inconsistent authentication depending on the connection URL format used. Specifically, authentication may fail when using a generic domain URL (e.g., ldaps://domain.com:port) while succeeding when using a server-specific Fully Qualified Domain Name (FQDN) (e.g., ldaps://server.domain.com:636).

User authentication is inconsistent based on the connection URL format:

  • Authentication fails when using generic domain URL: ldaps://#####.com:port#
  • Authentication succeeds when using server-specific FQDN: ldaps://#####.#####.com:636

 Observations:

  1. The connection test validates successfully in both cases.
  2. Same settings work in the test environment.
  3. Tried configuring multiple LDAPS entry, however, looks like those are not being picked up by IAM.
  4. During failure, the error logs shows auth_method="openid-connect"

Authentication failure:

2026-08-14 15:13:53,555 INFO  [com.ca.ad.sv.keycloak.ext.ldap.DevTestAuthProvider] (executor-thread-7) User federation object [Provider 1] of type [ad] with id [2211e969-6be5-4689-af82-70f35fd0772a] was updated successfully

2026-08-14 15:14:30,119 WARN  [org.keycloak.events] (executor-thread-7) type="LOGIN_ERROR", realmId="service_virtualization", realmName="service_virtualization", clientId="security-admin-console", userId="13f54262-5ff7-4c4e-bb84-9e44ff6cc1f1", ipAddress="##.##.#.##", error="invalid_user_credentials", auth_method="openid-connect", auth_type="code", application="Identity And Access Manager", redirect_uri=https://##.#####.#####.com:51111/admin/service_virtualization/console/, code_id="6bea553b-5883-41d3-9063-a4100fbbe013", username="userid1"

Authentication Successful:

2026-08-14 15:16:42,202 DEBUG [org.keycloak.storage.ldap.idm.store.ldap.LDAPContextManager] (executor-thread-14) Creating LdapContext using properties: [{java.naming.security.authentication=simple, java.naming.provider.url=ldaps://#####.#####.com:636, java.naming.ldap.attributes.binary=objectGUID, java.naming.security.principal=cn=LDAP_FOR_SV_USER,ou=Services,OU=UserAccounts,DC=#####,DC=com, java.naming.security.credentials=**************************************, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.ldap.factory.socket=org.keycloak.truststore.SSLSocketFactory, com.sun.jndi.ldap.connect.pool=true}]

Environment

All supported DevTest releases.

Cause

This often indicates that user records imported from disabled LDAP providers are causing conflicts, or that the LDAP provider configuration requires optimization for multiple endpoints.

Resolution

To resolve inconsistent authentication and configure multiple LDAPS URLs for user federation, follow these steps:

1. Configuration for Multiple LDAPS URLs
Rather than creating separate User Federations, you can use a single provider string to support multiple LDAPS URLs. Connection URL format: Provide each full connection string for every LDAPS server, separated by a single space. Ensure the full ldaps:// protocol is included for each URL.

2. Update Service VM Options
Add the following property to the IAM_HOME\bin\IdentityAccessManagerService.vmoptions file to manage the connection pool: -Dcom.sun.jndi.ldap.connect.pool.timeout=300000

3. Set Timeout Parameters
Adjust the following timeouts in the Identity Access Manager (IAM) configuration to ensure stability:

  • Connection Timeout: Set to 5000 (in milliseconds).
  • Read Timeout: Set to 10000 (in milliseconds; applies to LDAP read operations).

4. Database & Cache Cleanup
If you encounter duplicate user entries in the database, clear the cache and temporarily disable the user import functionality. Ensure all previously imported users from disabled LDAP sources are removed, as these often cause authentication conflicts.

5. Restart Services
Restart the Identity Access Manager (IAM) service after applying the changes above.




Additional Information

  • Applicable Releases: All supported DevTest releases.
  • Root Cause Context: Issues frequently arise from hostname mismatches or stale user records remaining from previously disabled LDAP providers.
  • Validation: Use the connection test within the IAM UI to verify that the system correctly identifies the user source after updating the URLs and timeout settings.
Powered by Wolken Software