Wildfly has token-realm. But currently is missing "Ability to load the attributes of an identity from multiple sources". We are aware of this limitation and it is in plan.
Couldn't that be solved on keycloak level? If both roles and groups are known to keycloak, couldn't it be filled into roles at once there?
Thank you for the information.
I think I can solve in Keycloak adding a role with group name to every group.
Is there a JIRA for this already? If so, please provide a link.