mirror of
https://github.com/hanzoai/kms.git
synced 2026-11-03 01:10:24 +00:00
zeekay
0ebffbd529
- Fix 381 files where branding script corrupted variable names (e.g. isHanzo KMSTemplate -> isKmsTemplate) - Rebrand from "Hanzo KMS" to just "KMS" for white-label support (allows Lux KMS, Hanzo KMS, etc. via configuration) - 856 files, purely string replacements, no logic changes
62 lines
3.1 KiB
Plaintext
62 lines
3.1 KiB
Plaintext
---
|
|
title: "Keycloak OIDC Group Membership Mapping"
|
|
sidebarTitle: "Group Membership Mapping"
|
|
description: "Learn how to sync Keycloak group members to matching groups in KMS."
|
|
---
|
|
|
|
You can have KMS automatically sync group
|
|
memberships between Keycloak and KMS by configuring a group membership mapper in Keycloak.
|
|
When a user logs in via OIDC, they will be added to KMS groups that match their Keycloak groups names, and removed from any
|
|
KMS groups not present in their groups claim.
|
|
|
|
<Info>
|
|
When enabled, manual
|
|
management of KMS group memberships will be disabled.
|
|
</Info>
|
|
|
|
<Warning>
|
|
Group membership changes in the Keycloak only sync with KMS when a
|
|
user logs in via OIDC. For example, if you remove a user from a group in Keycloak, this change will not be reflected in KMS until their next OIDC login. To ensure this behavior, KMS recommends enabling Enforce OIDC
|
|
SSO in the OIDC settings.
|
|
</Warning>
|
|
|
|
|
|
<Steps>
|
|
<Step title="Configure a group membership mapper in Keycloak">
|
|
1.1. In your realm, navigate to the **Clients** tab and select your KMS client.
|
|
|
|
|
|
|
|
1.2. Select the **Client Scopes** tab.
|
|
|
|
|
|
|
|
1.3. Next, select the dedicated scope for your KMS client.
|
|
|
|
|
|
|
|
1.4. Click on the **Add mapper** button, and select the **By configuration** option.
|
|
|
|
|
|
|
|
1.5. Select the **Group Membership** option.
|
|
|
|
|
|
|
|
1.6. Give your mapper a name and ensure the following properties are set to the following before saving:
|
|
- **Token Claim Name** is set to `groups`
|
|
- **Full group path** is disabled
|
|
|
|
|
|
</Step>
|
|
<Step title="Setup groups in KMS and enable OIDC Group Membership Mapping">
|
|
2.1. In KMS, create any groups you would like to sync users to. Make sure the name of the KMS group is an exact match of the Keycloak group name.
|
|
|
|
|
|
2.2. Next, enable **OIDC Group Membership Mapping** on the **Single Sign-On (SSO)** page under the **General** tab.
|
|
|
|
|
|
2.3. The next time a user logs in they will be synced to their matching Keycloak groups.
|
|
|
|
</Step>
|
|
</Steps> |