From 884accdb5fdf42488d7709693680203b5df08287 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sat, 26 Jul 2025 11:22:47 +0200
Subject: [PATCH] feat: Add group membership mapper and groups claim and scope

---
 terraform/keycloak.tf | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/terraform/keycloak.tf b/terraform/keycloak.tf
index 3ef6508..b32cbe2 100644
--- a/terraform/keycloak.tf
+++ b/terraform/keycloak.tf
@@ -74,6 +74,21 @@ resource "keycloak_oidc_identity_provider" "twomartens_github_identity_provider"
   ui_locales = true
 }
 
+resource "keycloak_openid_client_scope" "groups_scope" {
+  realm_id = keycloak_realm.twomartens_realm.id
+  name     = "groups"
+}
+
+resource "keycloak_openid_group_membership_protocol_mapper" "group_membership_mapper" {
+  realm_id        = keycloak_realm.twomartens_realm.id
+  client_scope_id = keycloak_openid_client_scope.groups_scope.id
+  name            = "group-membership-mapper"
+
+  claim_name = "groups"
+}
+
+# from here clients
+
 resource "keycloak_openid_client" "twomartens_gitea" {
   realm_id              = keycloak_realm.twomartens_realm.id
   name                  = "Gitea"
@@ -151,6 +166,13 @@ resource "keycloak_openid_client" "twomartens_wahlrecht_frontend" {
   ]
 }
 
+# from here ArgoCD
+
+resource "keycloak_group" "argocd_admins" {
+  realm_id = keycloak_realm.twomartens_realm.id
+  name = "ArgoCDAdmins"
+}
+
 resource "keycloak_openid_client" "twomartens_argocd_test" {
   realm_id              = keycloak_realm.twomartens_realm.id
   name                  = "ArgoCD Test Cluster"
@@ -168,7 +190,11 @@ resource "keycloak_openid_client" "twomartens_argocd_test" {
   ]
 }
 
-resource "keycloak_group" "argocd_admins" {
-  realm_id = keycloak_realm.twomartens_realm.id
-  name = "ArgoCDAdmins"
-}
\ No newline at end of file
+resource "keycloak_openid_client_optional_scopes" "argocd_optional_scopes" {
+  realm_id  = keycloak_realm.twomartens_realm.id
+  client_id = keycloak_openid_client.twomartens_argocd_test.id
+
+  optional_scopes = [
+    keycloak_openid_client_scope.groups_scope.name
+  ]
+}