how to use this with keycloak

[f1-outsourcing]

I have tried several ways to submit these roles, but I am constantly getting this default subscriber role.

{
  "sub": "6ae63411-cfe7-4331-9b73-28ff25fddcec",
  "email_verified": true,
  "user-realm-role": [
    "administrator",
    "offline_access",
    "uma_authorization"
  ],
  "name": "Test Test",
  "preferred_username": "xxxxxxx",
  "given_name": "Test",
  "family_name": "Test",
  "email": "test@xxxxxx.eu"
}

when I try to test, I get these errors

ttempt to read property "ID" on bool in ..../wp-content/plugins/oidc-wp-roles/src/Admin/SettingsTabTesting.php on line 96
[06-Feb-2026 23:19:51 UTC] PHP Fatal error: Uncaught TypeError: OidcRoles\Service\MappingsManager::setUser(): Argument #1 ($user) must be of type WP_User, bool given, called in .../wp-content/plugins/oidc-wp-roles/src/Admin/SettingsTabTesting.php on line 102 and defined in ..../wp-content/plugins/oidc-wp-roles/src/Service/MappingsManager.php:106

[timnolte]

Check the Wiki.

[f1-outsourcing]

Check the Wiki.

what wiki?

[timnolte]

Disregard I thought your question was about the main plugin. I don't think this extension was finished and actually working.

[f1-outsourcing]

I was also testing with your mu-plugin https://github.com/timnolte/oidc-keycloak-sso but get this as soon as I add it. (Logins were fine)

ERROR (cannot-authorize): Can not authorize.

[timnolte]

I haven't looked at that MU Plugin in awhile. It may also be broken with recent changes that have happened in the last month. That MU Plugin I think was also setup for an older version of keycloak so it's possible it's also not compatible with a newer version. The MU Plugin pretty much just uses the Open ID Connect Generic hooks for it's functionality. I believe it also adds additional settings into the plugin settings screen that also need to be populated.

[f1-outsourcing]

I got it to work. It was a bit of a mess trying this, since I am not really familiar with oidc and how to make the roles available. I think maybe also the default settings have changed in keycloak, which did not expose my roles when I thought they would be. AI was also misleading me with scopes and coding. Anyway I adapted your software so it does not require any more the role mappings to be configured in wordpress settings, and now it deletes some weirdly default added subscriber role (from the main plugin?). The new keycloak version has a really nice option to rename realm roles.