Keycloak 9 is several years out-of-date. The docs for OnDemand don’t get updated as quickly as Keycloak comes out with new releases. I’d strongly recommend trying with something like Keycloak 22. The setup is entirely different and in many cases it’s much simpler. OpenJDK - Keycloak.
The Test authentication and Test Connection only stress that Keycloak can connect to LDAP, it doesn’t stress that you configured the correct attribute mappings and DNs for where users are stored. I’d have to see a LDIF dump of a user from your LDAP to be able to advise what attributes to set. How data is stored in LDAP tends to be very site specific. I can show you what OSC has but our’s is far from standard so may not be useful:
{
"id" : "1596bc37-6ced-5ff5-8fc2-280746004334",
"name" : "OSC-LDAP",
"providerId" : "ldap",
"providerType" : "org.keycloak.storage.UserStorageProvider",
"parentId" : "osc",
"config" : {
"fullSyncPeriod" : [ "-1" ],
"useTruststoreSpi" : [ "never" ],
"usersDn" : [ "ou=People,dc=osc,dc=edu" ],
"cachePolicy" : [ "DEFAULT" ],
"priority" : [ "0" ],
"trustEmail" : [ "false" ],
"importEnabled" : [ "false" ],
"enabled" : [ "true" ],
"userObjectClasses" : [ "posixAccount" ],
"bindCredential" : [ "**********" ],
"usernameLDAPAttribute" : [ "uid" ],
"changedSyncPeriod" : [ "-1" ],
"bindDn" : [ "cn=read,ou=Admin,dc=osc,dc=edu" ],
"rdnLDAPAttribute" : [ "cn" ],
"vendor" : [ "other" ],
"editMode" : [ "READ_ONLY" ],
"uuidLDAPAttribute" : [ "entryUUID" ],
"connectionUrl" : [ "ldaps://ldap1.OMIT:636 ldaps://ldap2.OMIT:636 ldaps://ldap3.OMIT:636" ],
"syncRegistrations" : [ "false" ],
"authType" : [ "simple" ],
"batchSizeForSync" : [ "1000" ]
}
}
This is just the LDAP provider, you also have to setup mappers, like this one:
{
"id" : "67e276d3-4e1b-4d6a-a3f2-6a7ef11a8080",
"name" : "username",
"providerId" : "user-attribute-ldap-mapper",
"providerType" : "org.keycloak.storage.ldap.mappers.LDAPStorageMapper",
"parentId" : "1596bc37-6ced-5ff5-8fc2-280746004334",
"config" : {
"ldap.attribute" : [ "uid" ],
"is.mandatory.in.ldap" : [ "true" ],
"read.only" : [ "true" ],
"always.read.value.from.ldap" : [ "false" ],
"user.model.attribute" : [ "username" ]
}
}
I believe Keycloak comes with some built-in mappers but they will only work if your LDAP schema uses the attributes they are setup for. You may have to create your own mappers.
Once you have the correct LDAP provider and mappers you should be able to navigate to the Users section of Keycloak and search for LDAP users and see them with their data populated based on the mappers you setup.