<titledata-rh="true">Keycloak | OAuth2 Proxy</title><metadata-rh="true"name="viewport"content="width=device-width,initial-scale=1"><metadata-rh="true"name="twitter:card"content="summary_large_image"><metadata-rh="true"property="og:url"content="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/keycloak"><metadata-rh="true"name="docusaurus_locale"content="en"><metadata-rh="true"name="docsearch:language"content="en"><metadata-rh="true"name="docusaurus_version"content="current"><metadata-rh="true"name="docusaurus_tag"content="docs-default-current"><metadata-rh="true"name="docsearch:version"content="current"><metadata-rh="true"name="docsearch:docusaurus_tag"content="docs-default-current"><metadata-rh="true"property="og:title"content="Keycloak | OAuth2 Proxy"><metadata-rh="true"name="description"content="This is the legacy provider for Keycloak, use Keycloak OIDC Auth Provider if possible."><metadata-rh="true"property="og:description"content="This is the legacy provider for Keycloak, use Keycloak OIDC Auth Provider if possible."><linkdata-rh="true"rel="icon"href="/oauth2-proxy/img/logos/OAuth2_Proxy_icon.svg"><linkdata-rh="true"rel="canonical"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/keycloak"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/keycloak"hreflang="en"><linkdata-rh="true"rel="alternate"href="https://oauth2-proxy.github.io/oauth2-proxy/docs/next/configuration/providers/keycloak"hreflang="x-default"><linkrel="stylesheet"href="/oauth2-proxy/assets/css/styles.4014daec.css">
flags can be used to specify which groups to limit access to.</p><p>If these are unset but a <code>groups</code> mapper is set up above in step (3), the provider will still
populate the <code>X-Forwarded-Groups</code> header to your upstream server with the <code>groups</code> data in the
Keycloak userinfo endpoint response.</p><p>The group management in keycloak is using a tree. If you create a group named admin in keycloak