[keycloak-user] Auth with Kaycloak

Hi, I would like to know how to implement auth using Keyclock for an existing model using JAAS & LDAP. Currently a user is aithenticated with LDAP directly from login module. If the user is in LDAP group, those roles will be set. If there is no group for a user in LDAP, some hard coded roles will be set from login module. When Keyclock is used, what kind of role mapping required for this scenario? How to do this conditional role mapping? Thanks!