ISSUE: IPA domain needs ldap_user_extra_attrs in sssd.conf

[spoore1]

When an IPA Integration Domain is enabled and setup, the sssd.conf file is missing the ldap_user_extra_attrs setting in the domain section.

When the setting is missing, I'm unable to see IPA users reflected in Keycloak. To resolve the issue, I'm adding the following after setting up an IPA Integration Domain:

ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname

[spoore1]

@f-trivino I ran a test with the latest updates and I'm still seeing this issue.

This is what I'm doing to reproduce this (using containers from this PR):

1. Setup basic freeipa server, ipa-tuura, and keycloak

sudo make container
sudo make up-gating

This should start dns, ipa, ipa-tuura, and keycloak containers

2. Add IPA integration domain

sudo make bridge

Should add IPA Integration Domain which runs ipa-client-install on ipa-tuura

3. Add IPA user

ipa user-add ipauser1 ....

4. Lookup user from Keycloak

/opt/keycloak/bin/kcadm.sh get users -q username=ipauser1

Expected results should look something like:

[ {
  "id" : "7f075f36-d891-445b-a8f8-49b7eda4086f",
  "createdTimestamp" : 1685478261805,
  "username" : "ipauser2",
  "enabled" : true,
  "totp" : false,
  "emailVerified" : false,
  "firstName" : "ipauser2",
  "lastName" : "ipauser2.last",
  "email" : "[email protected]",
  "federationLink" : "44567635-a5ff-4806-b201-c5e3800702ec",
  "disableableCredentialTypes" : [ ],
  "requiredActions" : [ ],
  "notBefore" : 0,
  "access" : {
    "manageGroupMembership" : true,
    "view" : true,
    "mapRoles" : true,
    "impersonate" : true,
    "manage" : true
  }
} ]

Actual results:

HTTP error - 400 Bad Request

Fix seems to just be adding this line to domain section of sssd.conf on ipa-tuura system:

ldap_user_extra_attrs = mail:mail, sn:sn, givenname:givenname

After that, if I add a new IPA user and search from Keycloak, I can see it. Hence the working ipauser2 entry above that I saw after the fix.