title: Map groups to roles in Keycloak when using OIDC
body: <p>I have Azure AD connected to Keycloak via OpenID Connect. I want to do the following:</p>
  <ul>
  <li>If user &quot;Romeo&quot; is a member of the group &quot;Montague&quot; in AD, he should have the role &quot;lover&quot; in Keycloak</li>
  <li>I don't want to import all AD groups and users, users are imported on first login</li>
  <li>the role &quot;lover&quot; is defined in Keycloak</li>
  <li>this should work on the realm level and work the same for different clients</li>
  </ul>
  <p>All examples I could find only explain how to do this using LDAP.</p>