Add configuration option for LDAP referral (#24852)

Signed-off-by: Tero Saarni <tero.saarni@est.tech>

federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPConfig.java

@@ -255,6 +255,10 @@ public class LDAPConfig {
         }
     }
 
+    public String getReferral() {
+        return config.getFirst(LDAPConstants.REFERRAL);
+    }
+
     public void addBinaryAttribute(String attrName) {
         binaryAttributeNames.add(attrName);
     }

federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProviderFactory.java

@@ -203,6 +203,9 @@ public class LDAPStorageProviderFactory implements UserStorageProviderFactory<LD
                 .type(ProviderConfigProperty.BOOLEAN_TYPE)
                 .defaultValue("true")
                 .add()
+                .property().name(LDAPConstants.REFERRAL)
+                .type(ProviderConfigProperty.STRING_TYPE)
+                .add()
                 .property().name(KerberosConstants.ALLOW_KERBEROS_AUTHENTICATION)
                 .type(ProviderConfigProperty.BOOLEAN_TYPE)
                 .defaultValue("false")

federation/ldap/src/main/java/org/keycloak/storage/ldap/idm/store/ldap/LDAPContextManager.java

@@ -235,6 +235,11 @@ public final class LDAPContextManager implements AutoCloseable {
             env.put("java.naming.ldap.attributes.binary", binaryAttrs);
         }
 
+        String referral = ldapConfig.getReferral();
+        if (referral != null) {
+            env.put(Context.REFERRAL, referral);
+        }
+
         return new Hashtable<>(env);
     }
 

js/apps/admin-ui/maven-resources/theme/keycloak.v2/admin/messages/messages_en.properties

@@ -2918,3 +2918,5 @@ invalidEmailMessage='{{0}}': Invalid email address.
 missingLastNameMessage='{{0}}': Please specify last name.
 missingEmailMessage='{{0}}': Please specify email.
 missingPasswordMessage='{{0}}': Please specify password.
+referral=Referral
+referralHelp=Specifies if LDAP referrals should be followed or ignored. Please note that enabling referrals can slow down authentication as it allows the LDAP server to decide which other LDAP servers to use. This could potentially include untrusted servers.

js/apps/admin-ui/src/user-federation/ldap/LdapSettingsSearching.tsx

@@ -30,6 +30,7 @@ export const LdapSettingsSearching = ({
   const [isSearchScopeDropdownOpen, setIsSearchScopeDropdownOpen] =
     useState(false);
   const [isEditModeDropdownOpen, setIsEditModeDropdownOpen] = useState(false);
+  const [isReferralDropdownOpen, setIsReferralDropdownOpen] = useState(false);
 
   return (
     <>
@@ -403,6 +404,37 @@ export const LdapSettingsSearching = ({
             )}
           ></Controller>
         </FormGroup>
+        <FormGroup
+          label={t("referral")}
+          labelIcon={
+            <HelpItem helpText={t("referralHelp")} fieldLabelId="referral" />
+          }
+          fieldId="kc-referral"
+        >
+          <Controller
+            name="config.referral.0"
+            defaultValue=""
+            control={form.control}
+            render={({ field }) => (
+              <Select
+                toggleId="kc-referral"
+                onToggle={() =>
+                  setIsReferralDropdownOpen(!isReferralDropdownOpen)
+                }
+                isOpen={isReferralDropdownOpen}
+                onSelect={(_, value) => {
+                  field.onChange(value as string);
+                  setIsReferralDropdownOpen(false);
+                }}
+                selections={field.value}
+                variant={SelectVariant.single}
+              >
+                <SelectOption value="ignore" isPlaceholder />
+                <SelectOption value="follow" />
+              </Select>
+            )}
+          ></Controller>
+        </FormGroup>
       </FormAccess>
     </>
   );

server-spi-private/src/main/java/org/keycloak/models/LDAPConstants.java

@@ -145,6 +145,8 @@ public class LDAPConstants {
 
     public static final String LDAP_MATCHING_RULE_IN_CHAIN = ":1.2.840.113556.1.4.1941:";
 
+    public static final String REFERRAL = "referral";
+
     public static String getUuidAttributeName(String vendor) {
         if (vendor != null) {
             switch (vendor) {