# Keycloak-operator KubeClient Groups mapper example

**URL:** <https://forum.keycloak.org/t/keycloak-operator-kubeclient-groups-mapper-example/10625>\
**Category:** Getting advice\
**Created:** [August 20, 2021, 3:55pm UTC](https://forum.keycloak.org/t/keycloak-operator-kubeclient-groups-mapper-example/10625 "2021-08-20T15:55:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kfox1111](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kfox1111/32/3744_2.png) [@kfox1111](https://forum.keycloak.org/u/kfox1111)\
**Post date:** [August 20, 2021, 3:55pm UTC](https://forum.keycloak.org/t/keycloak-operator-kubeclient-groups-mapper-example/10625/1 "2021-08-20T15:55:00Z")

</div>

Does anyone have an example of a Kubernetes kind: KeycloakClient object that configures the client to add the keycloak groups into the “groups” field of the ID token?

---

<div class="post-metadata">

**Author:** ![vmuzikar](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/vmuzikar/32/20_2.png) [@vmuzikar](https://forum.keycloak.org/u/vmuzikar)\
**Post date:** [August 23, 2021, 9:09am UTC](https://forum.keycloak.org/t/keycloak-operator-kubeclient-groups-mapper-example/10625/2 "2021-08-23T09:09:33Z")

</div>

Hi, it should be possible using [mappers](https://www.keycloak.org/docs/latest/server_admin/index.html#_protocol-mappers), see [Client CRD](https://github.com/keycloak/keycloak-operator/blob/b7e20f8ae37c95ac29f4e062ddfca311542cbf9a/deploy/crds/keycloak.org_keycloakclients_crd.yaml#L523). The config in the CRs mimics the REST API, so I’d suggest to try to configure it at first using the Admin Console, watch the browser dev console for the REST API requests to see how exactly the configuration is supposed to look, and then configure it in the same way in the CR.

---

<div class="post-metadata">

**Author:** ![kfox1111](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kfox1111/32/3744_2.png) [@kfox1111](https://forum.keycloak.org/u/kfox1111)\
**Post date:** [August 24, 2021, 7:30pm UTC](https://forum.keycloak.org/t/keycloak-operator-kubeclient-groups-mapper-example/10625/3 "2021-08-24T19:30:30Z")

</div>

For the record, using @vmuzikar’s help, this is an example of how to do it:

```
protocolMappers:
- name: groups
  id: 9a1c47d4-1e01-4ed2-9b38-e08ed7d22daa
  protocol: openid-connect
  protocolMapper: oidc-group-membership-mapper
  consentRequired: false
  config:
    "full.path": "true"
    "id.token.claim": "true"
    "access.token.claim": "true"
    "userinfo.token.claim": "true"
    "claim.name": groups
```