Map groups to roles in Keycloak when using OIDC

user_58962 0
Viewed 1429

I have Azure AD connected to Keycloak via OpenID Connect. I want to do the following:

  • If user "Romeo" is a member of the group "Montague" in AD, he should have the role "lover" in Keycloak
  • I don't want to import all AD groups and users, users are imported on first login
  • the role "lover" is defined in Keycloak
  • this should work on the realm level and work the same for different clients

All examples I could find only explain how to do this using LDAP.

keycloak openid-connect
1 Answers

This is surprisingly difficult, but possible. Heres how:

  • Azure Active Directory does not return group memberships by default. To activate it:
    • go to your app registration
    • go to Manage > Manifest
    • set the value for the "groupMembershipClaims" key to "All", so that the line looks like this: "groupMembershipClaims": "All",
    • save
  • Keycloak does not request the groups scope per default. To do this:
    • in the Keycloak Admin UI, go to Configure > Client Scopes
    • click "create"
    • enter name: "groups"
    • enable "Include In Token Scope"
    • enable "Display On Consent Screen"
    • save
    • then, add the groups scope to the "Default Client Scopes"
  • still in Keycloak, go to your identity provider
    • create a new mapper
    • Mapper Type: "Claim To Role"
    • Claim: "groups"
    • Claim Value: enter the Object ID, not the name of the AD group that you wish to use as the trigger for role assignment
    • Role: select the desired role
    • save
user_589620
Related