External IDP: Incorporate all user groups or roles #42077

robrez · 2025-08-23T00:46:17Z

robrez
Aug 23, 2025

Keycloak Realm 1 delegates to Keycloak Realm 2
Realm 2 is configured to add user roles and groups to claims.
I want the User groups or roles in Realm 1 to incorporate those from Realm 2... all of them.

For example, if claims from realm 2 are:

{
  groups: [ 'foo/bar/baz', 'blah' ]
}

I want the user to be in those groups in realm 1. I can (pre) create symmetric groups in realm 1 if needed.

Is something like this possible? Or, would I need to use "advance claim to [group/role]" and create a mapper for every possible group?