Jira SSO OpenID Automatic Groups Sync

[Guus Damen]

Hi Everyone,

I have been able to connect JIRA to my Keycloak instance through the SSO for Atlassian Server and Data Center plugin (https://marketplace.atlassian.com/apps/1216096/sso-for-atlassian-server-and-data-center?tab=overview&hosting=datacenter), which in turn retrieves users from an Active Directory (AD). This specific Active Directory does not contain groups by design. Our goal is to assign users to groups in JIRA itself.

Here comes the problem: the plugin automatically synchronizes the groups from Keycloak and as there are no groups, the user's groups in JIRA get overwritten. 

Example:

User A authentications on JIRA -> Administrator assigns group to user A -> User A logs in again -> groups are lost due to synchronization.

Is there anyway to avoid this problem?