# Keycloak claim mapper

**URL:** <https://forum.keycloak.org/t/keycloak-claim-mapper/18634>\
**Category:** Getting advice\
**Tags:** authentication, oidc\
**Created:** [November 27, 2022, 4:20pm UTC](https://forum.keycloak.org/t/keycloak-claim-mapper/18634 "2022-11-27T16:20:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dj\_kill](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dj_kill/32/7099_2.png) [@dj\_kill](https://forum.keycloak.org/u/dj_kill)\
**Post date:** [November 27, 2022, 4:20pm UTC](https://forum.keycloak.org/t/keycloak-claim-mapper/18634/1 "2022-11-27T16:20:23Z")

</div>

Hello.

I’m trying to integrate Keycloak with MinIO. Keycloak v20.0.1 and probably it’s Ok since integration with a bunch of other products works well.  
For the MinIO I need to configure a claim which provides group info and this group should map MinIO existing groups.  
In Keycloak I’ve created client and added groups to the client scopes.  
I created a group `consoleAdmin` which is exactly the same as in MinIO.  
I created a mapper `consoleAdmin` Group membership type which creates Token Claim Name for client.  
Almost everything as per [manual](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md) taking into account that manual is for quite old version.

Now every time I’m trying to login with SSO MinIO complains about policy name:  
`None of the given policies (`/consoleAdmin`) are defined, credentials will not be generated`

This means that for some reason it receives group information with the `/` in front of the group name. Can I fix this somehow on the Keycloak side? Or this is MinIO application issue and it is not compatible with current Keycloak realization? I don’t think this is MinIO issue since it should be just OpenID standard thingy…

Any advice on how can I configure this properly?  
Thanks in advance!

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [November 28, 2022, 9:42pm UTC](https://forum.keycloak.org/t/keycloak-claim-mapper/18634/2 "2022-11-28T21:42:50Z")

</div>

When you add the mapper, are you adding “From predefined mappers” or “By configuration”? If you select “By configuration” and select “Group Mapper”, setting the “Full group path” to false should include the group name without the `/`.