This message was deleted.

We ended up going back to LDAP bc of this limitation. Another gotcha you'll encounter is if a user is deleted in Keycloak and then recreated, you have to manually clean up the user on Rancher or it throws an error about a conflict.

I haven't used it but isn't that what the OIDC group claim is for?