# Role AND group mapping with custom oauth using keycloak **URL:** \ **Category:** Community Support\ **Created:** [February 9, 2021, 3:30pm UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307 "2021-02-09T15:30:57Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [February 9, 2021, 3:30pm UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/1 "2021-02-09T15:30:57Z")
### Description I am trying to set up group and role mapping from keycloak to rocketchat. Role mapping works fine, but when i want to add group mapping as well, nothing happens. Is it even possible? Because there is only one field for group/role mapping in the customoauth settings. Thanks for your help. ### Server Setup Information - Version of Rocket.Chat Server: 3.8.8 - Operating System: Debian stretch - Deployment Method: docker on k8s - Number of Running Instances: 1 - DB Replicaset Oplog: - NodeJS Version: - MongoDB Version: - Proxy: - Firewalls involved: ### Any additional Information ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 16, 2021, 5:06am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/2 "2021-11-16T05:06:37Z")
We can create the user in keycloak and that user can log in with rocket chat. My question is can we make this user as admin for rocketchat using keycloak?? ---
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [November 16, 2021, 10:11am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/3 "2021-11-16T10:11:21Z")
Hello, here is the documentation for that [Keycloak - Rocket.Chat Docs](https://docs.rocket.chat/guides/administration/misc.-admin-guides/authentication/open-id-connect/keycloak) But only works until RC 3.18.3, the feature was removed in \>4.x. ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 16, 2021, 10:33am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/4 "2021-11-16T10:33:16Z")
Thanks @d3h, I have followed this Blog but no use… Here I have given the details **adding the required roles to client** ![Screenshot from 2021-11-16 15-54-22](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/1/10d077d0d128cfb9b9d8d1f241e5a32064440ad3.png) **Details of Role** ![Screenshot from 2021-11-16 15-54-39](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/4/4bdeba5e189912a2f44a751c34765729fbac84b9.png) **Adding the mappers for the client** ![Screenshot from 2021-11-16 15-51-00](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/a/a1f29e7f714b1ec12543d5c131e704a06a2e7a19.png) **Mappers details** ![modified](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/5/5a10356bf24f5284b19b64f8d569773cbc9ea7f9.jpeg) **Add that role to user** ![Screenshot from 2021-11-16 15-51-59](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/c/c0e559d40b61a2709eb10cab2b4162e1d576ee62.png) Please help with this ---
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [November 16, 2021, 11:00am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/5 "2021-11-16T11:00:11Z")
There is no need to make a composite role. Just create the role for the client. Create the mapper and give the role to the user. ---
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [November 16, 2021, 11:01am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/6 "2021-11-16T11:01:47Z")
And you need to set the role mapper in Rc-Administration-Menu \> Oauth too. ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 16, 2021, 11:15am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/7 "2021-11-16T11:15:27Z")
Thank you @d3h . I need one small clarification. Did you say the below items ?? ![Screenshot from 2021-11-16 16-39-38](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/4/469926c3ab76c0dab0ce535293e4c7137443d36f.png) ---
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [November 16, 2021, 11:28am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/8 "2021-11-16T11:28:24Z")
![image](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/e/ee255b832bc574ddd45d45d5e35c95a20c9efc8f.png) Sorry for the german screenshot, but it’s the one above the Roles/Groups field for channel mapping ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 16, 2021, 11:39am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/9 "2021-11-16T11:39:36Z")
Thank you so much @d3h, I will try this ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 16, 2021, 12:38pm UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/10 "2021-11-16T12:38:01Z")
Hi, @d3h I have tried this. But I can’t make the keycloak created user as an admin of rocket chat. I have both keyclaok and the rocketchat was in docker. Here there is no rocket chat administrative access. ![Screenshot from 2021-11-16 17-32-47](https://us1.discourse-cdn.com/flex021/uploads/rocketchat/original/2X/a/afa88b1ed3654bc187acf7e46381cde6faf357f6.png) ---
**Author:** ![d3h](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@d3h](https://forums.rocket.chat/u/d3h)\ **Post date:** [November 16, 2021, 2:10pm UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/11 "2021-11-16T14:10:42Z")
Did you relog? You can check your access token in keycloak under client scope \> evaluate. Then there must be something like `roles { admin }` ---
**Author:** ![arunodhayam](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@arunodhayam](https://forums.rocket.chat/u/arunodhayam)\ **Post date:** [November 17, 2021, 5:56am UTC](https://forums.rocket.chat/t/role-and-group-mapping-with-custom-oauth-using-keycloak/10307/12 "2021-11-17T05:56:18Z")
Ok @d3h I will check