
### Step 4: Copy your client secret {#keycloak-step-4}
Navigate to "Credentials" and copy your client secret. You'll need to add this to the Unleash configuration later, so put it somewhere you'll be able to find it.

### Step 5: Copy your OpenID endpoint configuration {#keycloak-step-5}
Navigate to your realm settings and copy the link to OpenID endpoint configuration. You'll need to add this to the Unleash configuration later.

### Step 6: Create a new Client Scope and Map Groups {#keycloak-step-6}
Navigate to the "Client Scopes" page and select "Create Client Scope".

Give your new scope a name. Set the type to "Optional". Make sure the protocol is set to "OpenID Connect" and the "Include in Token Response" option is enabled. Save your new scope.


Select the Group Membership mapper.

Give your mapper a claim name, this must match the "Group Field JSON Path" in Unleash, and turn off the "Full group path" option.

## Unleash Configuration
### Step 1: Navigate to the Unleash SSO Configuration {#unleash-step-1}
Log in to Unleash as an admin user and navigate to the SSO configuration. Input your Client Secret (copied in step 3 of the Keycloak configuration), your Discover URL (copied in step 4 of the Keycloak configuration), and the Client ID (from step 2 of the Keycloak configuration).

### Step 2: Enable Group Syncing {#unleash-step-2}
Turn on Group Syncing and set a value for "Group Field JSON Path". This must match the value in claim name in Keycloak exactly. Save your configuration.

### Step 3: Enable Group Syncing for your Group {#unleash-step-3}
Navigate to Groups and select the group that you want to sync.

Edit the group.

Add as many SSO groups as you like. These need to match the Keycloak groups exactly.

Save your configuration. Once a user belonging to one of these Keycloak groups logs in through SSO, they'll be automatically added to this Unleash group.