Keycloak

It is mind boggling that group membership information is not returned by default by Keycloak for a user claim/token. You have to manually go into Client scopes and add it to the profile section. Client scope -> click on profile Mappers tab