Restrict KNIME Business Hub Login to Specific LDAP/AD Groups

Hi KNIME Community,

We have integrated our Active directory service with Keycloak using LDAP User Federation for KNIME Business Hub. Users are currently able to log in to KNIME Business Hub using their Active directory credentials.

Our environment has users across multiple domains, so the LDAP User DN/search base is currently configured at a higher/root level to allow Keycloak to find users across those domains.

We have also created three dedicated groups in Active directory for KNIME Business Hub access:

* KNIME-Admin

* KNIME-Dev

* KNIME-Viewer

Our requirement is to restrict login access to KNIME Business Hub so that only users who are members of at least one of these three groups in Active directory can authenticate and log in to the Hub.

Users who exist in the Active directory but are not members of any of these three groups should not be allowed to log in to KNIME Business Hub.

What is the recommended/supported way to achieve this with the Keycloak LDAP integration?

We would appreciate guidance on the supported configuration and any considerations when the LDAP search base needs to remain at a higher/root level because users are distributed across multiple domains.

Thank you!