You can use a group membership mapper on the client that will add the group details to the token. After that you can obtain it from KeycloakSecurityContext.getToken().getOtherClaims().get("claimName"). You can obviously only view and not manage groups from the token. To manage groups you'll need to use the admin rest api. On 26 December 2016 at 04:31, <smichea(a)gmail.com&gt; wrote: