Keycloak SCIM vs LDAP: Federation vs Provisioning

Keycloak 26.7 includes a native SCIM API, but SCIM does not replace LDAP user federation. LDAP lets Keycloak look up users in an existing directory and validate their passwords there. SCIM lets another system create, update, and remove users through a standard HTTP API. The choice depends mainly on where the accounts and passwords live today and which system owns their lifecycle.

The SCIM Realm API is Preview and off by default (--features=scim-api). Keycloak does not recommend Preview features for production. They can change or disappear between releases. Blog posts that still say Keycloak has no native SCIM are out of date for 26.7.x.

Keycloak SCIM vs LDAP: Quick Answer

Federation means Keycloak connects to an external user store and uses it while that store keeps managing the accounts. Provisioning means another system creates and updates user records in Keycloak.

SCIM is not an authentication protocol. It only manages identity records. Applications still sign in with OIDC or SAML. During that login, LDAP can validate the directory password when you use federation. For how LDAP and SCIM sit next to SAML and OIDC, see LDAP vs SAML vs OIDC vs SCIM.

  LDAP federation

  AD / LDAP ◄── lookup / password validation ── Keycloak ──► Applications
                                                  │              SAML/OIDC
                                                  │
                                                  └── may import user data

  SCIM provisioning

  HR / Entra / IGA ── SCIM ──► Keycloak ──► Applications
                                             SAML/OIDC login

The SAML/OIDC arrows show the authentication relationship; the browser normally participates in those login flows. With LDAP, Keycloak reaches out to the directory. With SCIM, another system calls Keycloak. In a realm that only has local users, SCIM writes into Keycloak’s database. If LDAP federation also has Sync Registrations enabled, a SCIM create can land in that directory instead. The coexistence warning later in this page covers that case.

When to Use LDAP, SCIM, or Both

Use LDAP federation when

• Users and passwords already live in AD, OpenLDAP, or 389 Directory Server
• Apps must keep validating against that directory through Keycloak
• You need group membership from the directory for roles and tokens
• You want a stable federation feature rather than a Preview API

  AD / LDAP ◄── lookup / password validation / sync ── Keycloak
                                                         │
                                                         │ OIDC / SAML
                                                         ▼
                                                    Applications

Use SCIM provisioning when

• An upstream cloud IdP or IGA tool must create and disable Keycloak users over a standard API
• After create, you will set credentials in Keycloak, or users will sign in through another IdP
• You accept Preview status and incomplete SCIM coverage
• You need Entra-style inbound provisioning rather than an LDAP bind from Keycloak

  HR / Entra / IGA ── SCIM ──► Keycloak ──► Applications
                                             SAML/OIDC login

Use both when

• Different populations need different owners (employees in LDAP, contractors through SCIM)
• LDAP authenticates one realm while SCIM feeds another
• SCIM provisions accounts while login goes through a broker IdP (not LDAP)

  Employees:   AD/LDAP ◄── LDAP federation ── Keycloak ──OIDC/SAML──► Apps
  Contractors: Entra   ── SCIM ─────────────► Keycloak ──OIDC/SAML──► Apps

Do not let LDAP and SCIM manage the same usernames unless you designed that ownership on purpose. Application protocol choice is covered in OAuth 2.0 vs OIDC vs SAML.

How LDAP User Federation Works in Keycloak

LDAP user federation makes Keycloak treat an external directory as a user store. On sign-in, Keycloak can search the directory, validate the password against LDAP, and optionally keep a local copy of attributes for tokens and Admin Console searches.

Typical LDAP federation steps:

• Connect with a service bind DN and search base
• Find the user entry, then validate the password on the LDAP server
• Optionally import users into the local database on first login or during sync
• Map attributes, groups, and roles through mappers
• Edit Mode controls where changes are stored: READ_ONLY blocks mapped-field updates, WRITABLE writes supported changes to LDAP, and UNSYNCED keeps changes in Keycloak’s local storage

Import Users changes how much lives in Keycloak. When it is on, Keycloak stores a local representation of LDAP users and can synchronize it. When it is off, Keycloak queries LDAP as the backing store without the same local copy. In both cases, LDAP validates passwords. Keycloak never imports LDAP password hashes.

In the usual design, LDAP stays authoritative for accounts and passwords. With WRITABLE edit mode, some profile changes may also write back from Keycloak to LDAP.

How Keycloak SCIM Works

SCIM (System for Cross-domain Identity Management) is an HTTP API for creating and updating identity resources. RFCs 7643 and 7644 define the schemas and protocol. In Keycloak 26.7.x, the Preview SCIM Realm API exposes /Users and /Groups under /realms/<realm>/scim/v2. Keycloak is the SCIM service provider. Other systems call it.

Start the server with --features=scim-api (or Preview features). Then enable SCIM on the realm under Realm settings, or set scimApiEnabled through the Admin REST API.

SCIM calls need an OAuth bearer token. Use a confidential client with a service account so the provisioning system can request that token on its own.

Roles to grant on the service account:

• manage-users for full user and group management through SCIM
• view-users, query-users, and query-groups when you only need read or search
• query-users or query-groups for discovery endpoints such as /ServiceProviderConfig (manage-users already implies those)

The access token must also list the realm’s SCIM base URL in its audience (aud). Without that claim, Keycloak returns 401 Unauthorized even when the client secret and roles are correct.

On my lab I listed users in a realm that already held alex:

curl -s "http://127.0.0.1:8081/realms/scimdemo/scim/v2/Users?count=5" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/scim+json"

Sample output (trimmed):

{
  "totalResults": 1,
  "Resources": [
    {
      "userName": "alex",
      "active": true
    }
  ]
}

totalResults and userName show the SCIM client can see realm users. Create and deactivate use POST or PATCH on /Users the same way. For a Keycloak lab baseline before you enable features, see Install Keycloak with Podman.

LDAP vs SCIM: Users, Groups, Passwords, and Lifecycle

SCIM does not set a login password. If that user will authenticate locally to Keycloak, establish credentials separately with a password reset or required action. Alternatively, let the user sign in through another identity provider. After the account exists, Admin Console user work still applies. See Keycloak users.

Test disable versus delete on a throwaway realm before you wire production offboarding.

Keycloak SCIM Limitations and LDAP Interactions

On Keycloak 26.7.x, scim-api is Preview: disabled by default, not recommended for production, and subject to change. Enable it with --features=scim-api (or Preview features), then turn on SCIM per realm.

Limits that matter when you choose between LDAP and SCIM:

• Password changes through SCIM are unsupported
• Bulk operations are unsupported
• Custom sorting is unsupported (sortBy / sortOrder may be accepted but ignored)
• Administrative users and groups: Keycloak protects accounts and groups that carry administrative roles from SCIM modification. SCIM can return a reduced representation for them, but PUT, PATCH, and DELETE are rejected with 403 Forbidden
• Sync Registrations: if Sync Registrations sends a SCIM-created user into LDAP and that LDAP provider does not import the user into Keycloak’s local database, the SCIM POST can succeed but later GET, list, search, or DELETE may not find that user
• Federated-user visibility: SCIM /Users searches return locally stored users and imported federated users. Non-imported LDAP users do not appear
• LDAP group mapper in LDAP_ONLY mode: SCIM membership filters such as groups.value and members.value may return no matches, because those filters query the local database while memberships stay only in LDAP. Use IMPORT mode when you need membership-based SCIM filtering
• Outbound SCIM: native SCIM today makes Keycloak a service provider. Keycloak as a SCIM client that federates from an external SCIM store is still future work
• LDAP federation remains the stable path for directory authentication

Re-check Preview status and these interactions after every Keycloak minor upgrade. Basic IAM vocabulary (IdP, realm, client) is covered in What is Keycloak?.

Summary

LDAP federation and SCIM provisioning solve different identity-management problems in Keycloak. LDAP federation looks up and authenticates people against a directory. SCIM lets an external system provision and deprovision identity records over HTTP. On Keycloak 26.7.3, LDAP is stable and long-established. SCIM is Preview, off by default, and still missing password management, bulk operations, and outbound SCIM federation.

Choose based on where the accounts and passwords are managed. If the directory owns passwords, federate with LDAP. If an upstream platform must create accounts that Keycloak or another IdP will authenticate, evaluate inbound SCIM and plan around Preview limits. When both run in one realm, test Sync Registrations, import settings, and SCIM search visibility before you trust the design.

Keep application login on OIDC or SAML either way. Provisioning never replaces the protocol your apps already speak.

References

• Managing users and groups through SCIM — Keycloak Server Administration Guide (authoritative for 26.7 permissions, audience, and LDAP interactions)
• User storage and LDAP — Keycloak Server Administration Guide
• All configuration — Features (scim-api Preview)
• Keycloak 26.7.0 release notes — SCIM API (preview)
• RFC 7643 — SCIM Core Schema
• RFC 7644 — SCIM Protocol
• SCIM Realm API announcement (Keycloak blog, April 2026) (historical 26.6 experimental announcement; prefer the Server Administration Guide for current behavior)