How to extract groups from this token of keycloak to send down to opa using trino?

[Tung2954]

So my work here are using 3 things: trino, opa and keycloak. On keycloak i have create some user, groups, realm, ... to test user authorization. By passing a token for trino to handle infomatiion, i expect trino to send the username and group down to opa but currently right now it only extract username ( maybe i missing some configuration or trino not support it yet?)

so here is the token detail:

{
"realm_access": {
"roles": [
"default-roles-test",
"offline_access",
"uma_authorization",
"data-engineer"
]
},
"resource_access": {
"trino-client": {
"roles": [
"trino_admin",
"trino_user"
]
},
"account": {
"roles": [
"manage-account",
"manage-account-links",
"view-profile"
]
}
},
"scope": "openid email profile",
"email_verified": false,
"name": "engineer_user User",
"groups": [
"data_engineer"
],
"preferred_username": "engineer_user",
"given_name": "engineer_user",
"family_name": "User",
"email": "[email protected]"
}