including keyclocak group IDs in token - token

Question

I am new to keyclocak. I have group assignments for users, and I was able to enable a group mapper, which puts groups (names only) in the token returned to a client. In my app, I need to associate data with groups, so I'd like for a way to add group IDs to the token.
Is there a way I can add the group ID to the token? Or, can my app query for group ids/names without having to have admin credentials on keycloak?

Answer 1

You can use a custom protocol mapper:
package org.sample;
import java.util.ArrayList;
import java.util.List;
import java.util.stream.Collectors;
import org.keycloak.models.ClientSessionContext;
import org.keycloak.models.KeycloakSession;
import org.keycloak.models.ProtocolMapperModel;
import org.keycloak.models.UserSessionModel;
import org.keycloak.protocol.oidc.mappers.AbstractOIDCProtocolMapper;
import org.keycloak.protocol.oidc.mappers.OIDCAccessTokenMapper;
import org.keycloak.protocol.oidc.mappers.OIDCAttributeMapperHelper;
import org.keycloak.protocol.oidc.mappers.OIDCIDTokenMapper;
import org.keycloak.protocol.oidc.mappers.UserInfoTokenMapper;
import org.keycloak.provider.ProviderConfigProperty;
import org.keycloak.representations.IDToken;
public class GroupIdProtocolMapper extends AbstractOIDCProtocolMapper implements OIDCAccessTokenMapper, OIDCIDTokenMapper, UserInfoTokenMapper {
public static final String PROVIDER_ID = "group-id-protocol-mapper";
private static final List<ProviderConfigProperty> configProperties = new ArrayList<>();
static {
OIDCAttributeMapperHelper.addTokenClaimNameConfig(configProperties);
OIDCAttributeMapperHelper.addIncludeInTokensConfig(configProperties, GroupIdProtocolMapper.class);
}
#Override
public String getId() {
return PROVIDER_ID;
}
#Override
public String getDisplayCategory() {
return TOKEN_MAPPER_CATEGORY;
}
#Override
public String getDisplayType() {
return "Group Id";
}
#Override
public String getHelpText() {
return "Map user group id to a token claim.";
}
#Override
public List<ProviderConfigProperty> getConfigProperties() {
return configProperties;
}
#Override
protected void setClaim(IDToken token, ProtocolMapperModel mappingModel, UserSessionModel userSession, KeycloakSession keycloakSession,
ClientSessionContext clientSessionCtx) {
List<String> groups = (List)userSession.getUser().getGroupsStream().map((g) -> {
return g.getId();
}).collect(Collectors.toList());
String protocolClaim = (String)mappingModel.getConfig().get("claim.name");
OIDCAttributeMapperHelper.mapClaim(token, mappingModel, groups);
}
}