a Keycloak broker mapper that maps a multivalued OIDC claim (e.g.: groups) or SAML attribute (e.g.: groupMembership) into one or more realm and/or client role assignments based on regular expressions

a Keycloak browser authenticator that enforces an impersonation policy restricting impersonators from accessing service providers (clients) unless holding an associated client role