[keycloak-user] "Mapper-spanning" LDAP federation and mapping "Composite Roles"

Hello there, I am trying to to import a rather large and complex AD structure into Keycloak and I am facing some rather substantial problems with that. First of all, I have some user groups whose members span over multiple subtrees. Example: Group OU 1 |- Group1 |- Group1.1 Group OU 2 |- Group2 |- Group2.2 Where Group1.1 is a member of Group1, Group2.2 is a member of Group2 and Group2 is a member of Group1. In reality it is a little bit more complex of course and makes much more sense ;-) Unfortunately, this doesn't seem to work as every group mapper only sees its own groups, which leads to (1) that the resulting group-order does not remotely match the one that's in AD and worse (2) when telling a group mapper to watch out for groups that do not exist in upstream anymore, it cleans up everything else. Second, there are (fortunately seperate) OUs containing groups that represent a set of rights granted to the user. Obviously, I want to map them as roles. What I cannot archieve is to map these roles, once I import them, to the groups they point to. Loading the roles recursively would probably possible as well, but I would like to stick to the AD structure as close as possible (I'm planning to connect Keycloak to different data sources as well and it would be pretty awesome to have some reporting against the keycloak db at a later stage). Third, there are quite a lot of groups with multiple "member"s in AD. When listing them, most of them have something in common: They are logically used to pool similar roles, so no one needs to manage them one by one. Which leads me to think that it would be quite accurate to map them as "composite roles". Unfortunately, this does not seem to be supported by the role mappers at all and if it was, it would probably also not work over mapper boundaries. TLDR; Keycloak is able to map groups and roles from AD but is completely missing functionality to do this cooperatively between mappers. I would love to know whether anyone can think of another as-good-as-possible-structure-preserving way of mapping this directory beast inside Keycloak. Also, I would love to hear about your thoughts regarding implementing some "cross-mapper" functionality for the LDAP connector and how far it can or should go to get this upstreamed later eventually so we can proceed with this on -dev :-) Thanks for reading! Marco