Keycloak 角色映射

Question

I have a spring boot application secured with keycloak. Each user in realm has roles for my resource (client). Roles are configuraed on users tab, for particular user under Role Mapping tab as Client Roles :

I also use integration with LDAP Active Directory , from which all the users came from. Now, if I want to add specific role for Active Directory (AD) group, I have to go to active directory, get all users for particular group and add desierd role via keycloak api in separeate application, which is extremly bad logic.

In previous version of keycloak (5.0.1) it had Script Mapper on javascript that could get Active Directory groups and map them into roles for a particular client. In the latest version 8.0.1 it has no such mapper.

I wonder, is there any mapper or other ability in latest version of Keycloak to map AD groups to resource roles. So, I could say that group_name has role user for client_name and role user appeared in keycloak token under resource_access . client_name . roles list

Answer 1

You can achieve what you want by following these steps:

1. Go to "Groups" on the left menu
2. Select the group
3. Using the "Role Mappings" tab, choose which client role should be assigned to members of that group.