groups claim

Gemini example

resource "okta_app_oauth" "keycloak_idp" {
 label       = "Keycloak Identity Broker"
 type        = "web"  # This tells Okta it's a standard web app (OIDC)
 status      = "ACTIVE"

 # The exact endpoint where Okta sends the login token back to Keycloak
 redirect_uris = [
   "https://keycloak.yourexample.com/realms/your-realm-name/broker/okta-oidc/endpoint"
 ]

 # Keycloak handles the Authorization Code flow natively
 grant_types   = ["authorization_code"]
 response_types = ["code"]

 token_endpoint_auth_method = "client_secret_post"
 consent_method             = "TRUSTED"

 # CRITICAL FOR BASIC LICENSE: This configures the Org Auth Server to 
 # include the user's groups inside the ID Token so Keycloak can read it.
 groups_claim {
   name        = "groups"
   type        = "FILTER"
   filter_type = "REGEX"
   value       = ".*"  # Matches and passes all groups the user belongs to
 }
}

Related

• Keycloak and Okta Integration: Complete Developer Guide: okta_app_oauth: web, groups_claim (to restrict access)
• okta_auth_server_claim
• Gemini Terraform code: Okta Keycloak integration

See also

• Terraform okta_app_oauth (ref), type, groups_claim, redirect_uris, grant_types, post_logout_redirect_uris, token_endpoint_auth_method
• Groups, chgrp, groupadd, groups, groupmod, OIDC groups, identityProviderMappers