Keycloak 26.2.5 : Active directory groups --Client roles #40882

abahmanem · 2025-07-03T07:56:42Z

abahmanem
Jul 3, 2025

Hello,

I recently installed Keycloak 26.2.5 and created a test realm.

I configured a connection to Active Directory (AD) as the user federation source.

I also imported AD groups (in a flat structure).
Additionally, I installed a custom theme for the login and the account UI.

I created five applications (clients) in the realm.

What I want to achieve:
Create roles linked to each application

Map these roles to corresponding Active Directory groups

For example:

App A <------> Role A <------> AD Group A
App B <------> Role B <------> AD Group B

So that when a user from AD Group A logs in, they see App A in their list of applications.

And if a user is part of both AD Group A and B, they will see both App A and App B in the Account Console → Applications section.

Of course, each application has its own internal access logic.

I tried to configure this setup, but it doesn't seem to work as expected.

My questions:

Is this kind of setup possible in Keycloak?

Is there any guide or documentation explaining how to achieve this?

I use another access management tool where this is easily configured, but I haven't been able to do the same with Keycloak.

Thank you.