[FEATURE] Please add "saml-role-list-mapper"

[Moep90]

We're adopting gitlab with SSO using SAML (since OIDC is not supported for groups...).

Sample Request for saml-role-list-mapper:

I hope it can be easily adopted via:
https://github.com/mrparkers/terraform-provider-keycloak/blob/master/keycloak/saml_user_property_protocol_mapper.go

Stolen from: #569

[...]
    {
        "id": "be741641-d8f1-47ab-985b-9384b62b8ea7",
        "name": "Allowed Protocol Mapper Types",
        "providerId": "allowed-protocol-mappers",
        "providerType": "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy",
        "parentId": "agent",
        "subType": "authenticated",
        "config": {
            "allowed-protocol-mapper-types": [
                **"saml-user-property-mapper",**
                "saml-role-list-mapper",
                "oidc-address-mapper",
                "oidc-full-name-mapper",
                "oidc-usermodel-attribute-mapper",
                "oidc-usermodel-property-mapper",
                "oidc-sha256-pairwise-sub-mapper",
                "saml-user-attribute-mapper"
            ]
        }
    },
[...]

[jeremymcgee73]

You can do this without having this added. You can use the keycloak_generic_client_protocol_mapper resource. I just got this working with AWS a bit ago.

resource "keycloak_generic_client_protocol_mapper" "aws-role" {
  realm_id        = data.keycloak_realm.realm_name.id
  client_id       = keycloak_saml_client.saml_client.id
  name            = "Session Role"
  protocol        = "saml"
  protocol_mapper = "saml-role-list-mapper"
  config = {
    "attribute.name"       = "https://aws.amazon.com/SAML/Attributes/Role"
    "attribute.nameformat" = "Basic"
    "friendly.name"        = "Session Role"
    "single"               = "true"
  }
}

[Moep90]

@jeremymcgee73 works like a charm! Thx for the heads up!