@@ -107,8 +107,9 @@ If you are using GitHub enterprise, make sure you set the following to the appro
107107
108108### Keycloak Auth Provider
109109
110−1. Create new client in your Keycloak with **Access Type** 'confidental'.
111−2. Create a mapper with **Mapper Type** 'Group Membership'.
110+1. Create new client in your Keycloak with **Access Type** 'confidental' and **Valid Redirect URIs** 'https://internal.yourcompany.com/oauth2/callback'
111+2. Take note of the Secret in the credential tab of the client
112+3. Create a mapper with **Mapper Type** 'Group Membership' and **Token Claim Name** 'groups'.
112113
113114Make sure you set the following to the appropriate url:
114115
@@ -116,8 +117,11 @@ Make sure you set the following to the appropriate url:
116117 -client-id=<client you have created>
117118 -client-secret=<your client's secret>
118119 -login-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/auth"
119− -redeem-url="http(s)://<keycloak host>/realms/master/<your realm>/openid-connect/auth/token"
120− -validate-url="http(s)://<keycloak host>/realms/master/<your realm>/openid-connect/userinfo"
120+ -redeem-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/token"
121+ -validate-url="http(s)://<keycloak host>/realms/<your realm>/protocol/openid-connect/userinfo"
122+ -keycloak-group=<user_group>
123+
124+The group management in keycloak is using a tree. If you create a group named admin in keycloak you should define the 'keycloak-group' value to /admin.
121125
122126### GitLab Auth Provider
123127