Sounds like you want to configure a Group Mapper: https://www.keycloak.org/docs/latest/server_admin/#_ldap_map...