# Group managment when using Bookstack with Keycloak Bookstack supports OIDC protocol and if you decide to use Keycloak as Single Sign On for Bookstack you can also assign users to Bookstack roles via Keycloak. Keycloak can not automatically create the roles on Bookstack so the first step is to create the roles on Bookstack. In order to manage users and groups via Keycloak you will need to follow the steps below: 1 - Go to the Bookstack admin panel ``` https:///settings/roles ``` and click Create New Role. Check existing roles to get an idea of the permissions. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/168T0MB9Y7G90v5F-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/168T0MB9Y7G90v5F-image.png) 2 - Choose a name for the role. Use the pattern Bookstack + Name of the role because we will later need to create this on Keycloak and it will be easier to identify if the name of the role starts with Bookstack. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/kWTbS6VY71AwRWhq-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/kWTbS6VY71AwRWhq-image.png) 3 - Choose the permission you want members of this role to have and than click Save role. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/FQcWcErnuwYLCD65-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/FQcWcErnuwYLCD65-image.png) This is all that is needed to be done on the Bookstack. 4 - Now go to your keycloak admin panel ``` https://ce.org/admin/ ``` and click on Groups on the sidepanel [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/SXijLmknSWmiTl1i-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/SXijLmknSWmiTl1i-image.png) 5 - Click on Create group so we can mirror the roles creates on Bookstack. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/WibKzfyynvIN55xr-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/WibKzfyynvIN55xr-image.png) 6 - Use the name you used on the Bookstack role. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/mKblEOlPQ547pQAy-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/mKblEOlPQ547pQAy-image.png) 7 - Once the role on Bookstack is created and the Group on Keycloak is created all you have to do is go to Members of the group on Keycloak to add existing users to the group. [![image.png](https://docs.cloud68.co/uploads/images/gallery/2026-09/scaled-1680-/DXtXMcLmn9z6wg1l-image.png)](https://docs.cloud68.co/uploads/images/gallery/2026-09/DXtXMcLmn9z6wg1l-image.png) 8 - For new users, assign them to the group when creating the new user. Steps on creating a new users and adding them to groups are here [https://docs.cloud68.co/books/single-sign-on-sso/page/how-to-create-a-user-on-keycloak](https://docs.cloud68.co/books/single-sign-on-sso/page/how-to-create-a-user-on-keycloak)

**After creating the roles with permissions on Bookstack and mirroring the group to Keycloak the user management is done on the Keycloak side. Users will need to log out and log in again in order to have the permissions of the roles they are assigned to.**