docs

docs/DEVELOPER-GUIDE.md

@@ -1336,16 +1336,34 @@ stringData:
 
 | Field | Required | Description |
 |-------|----------|-------------|
-| `clientId` | Yes | Keycloak client ID |
-| `name` | Yes | Display name in Keycloak |
-| `redirectUris` | Yes | Allowed redirect URIs |
-| `webOrigins` | Yes | Allowed web origins (CORS) |
-| `defaultClientScopes` | No | Scopes (default: `["openid", "email", "profile"]`) |
-| `protocolMappers` | No | Custom claim mappers (default: `[]`) |
-| `secret.namespace` | No | Namespace for the credential Secret (default: source namespace) |
-| `secret.name` | No | Name of the credential Secret (default: `<clientId>-oidc-credentials`) |
-| `secret.keys.clientId` | No | Key name for client ID in credential Secret (default: `client-id`) |
-| `secret.keys.clientSecret` | No | Key name for client secret in credential Secret (default: `client-secret`) |
+| `clientId` | Yes | Keycloak client ID (must be unique in realm) |
+| `name` | Yes | Display name in Keycloak UI |
+| `redirectUris` | Yes | Allowed OAuth redirect URLs (supports wildcards like `/*`) |
+| `webOrigins` | Yes | Allowed CORS origins |
+| `defaultClientScopes` | No | OIDC scopes (default: `["openid", "email", "profile"]`) |
+| `protocolMappers` | No | Custom claim mappers for tokens (see examples below) |
+| `secret.namespace` | No | Target namespace for credentials (default: `source-namespace` annotation value) |
+| `secret.name` | No | Credential Secret name (default: `<clientId>-oidc-credentials`) |
+| `secret.keys.clientId` | No | Key name for client ID (default: `client-id`) |
+| `secret.keys.clientSecret` | No | Key name for client secret (default: `client-secret`) |
+
+**Protocol Mappers Example**:
+```json
+"protocolMappers": [
+  {
+    "name": "groups",
+    "protocol": "openid-connect",
+    "protocolMapper": "oidc-group-membership-mapper",
+    "config": {
+      "claim.name": "groups",
+      "full.path": "false",
+      "id.token.claim": "true",
+      "access.token.claim": "true",
+      "userinfo.token.claim": "true"
+    }
+  }
+]
+```
 
 #### Step 2: Reference the Credential Secret