diff --git a/argilla-frontend/components/features/login/components/KeycloakLogo.vue b/argilla-frontend/components/features/login/components/KeycloakLogo.vue
new file mode 100644
index 0000000000..bf51bb2c83
--- /dev/null
+++ b/argilla-frontend/components/features/login/components/KeycloakLogo.vue
@@ -0,0 +1,164 @@
+<template>
+  <!--https://github.com/keycloak/keycloak-misc/blob/main/logo/icon.svg-->
+  <svg
+    width="256"
+    height="256"
+    viewBox="0 0 44.216 39.861"
+    fill="none"
+    xmlns="http://www.w3.org/2000/svg"
+  >
+    <path
+      d="m88.61 138.456 5.716-9.865 23.018-.004 5.686 9.965.007 19.932-5.691 9.957-23.012.008-5.782-9.965z"
+      style="
+        display: inline;
+        fill: #4d4d4d;
+        fill-opacity: 1;
+        stroke-width: 0.264583;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M88.552 158.481h10.375l-5.699-10.041 4.634-9.982-9.252-.002-5.795 10.065"
+      style="
+        fill: #ededed;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M102.073 158.481h7.582l6.706-9.773-6.589-10.156h-8.921l-5.373 9.814z"
+      style="
+        fill: #e0e0e0;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m82.815 148.52 5.738 9.964h10.374l-5.636-9.93z"
+      style="
+        fill: #acacac;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m95.589 148.522 6.484 9.963h7.582l6.601-9.959z"
+      style="
+        fill: #9e9e9e;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m98.157 148.529-1.958.569-1.877-.572 7.667-13.288 1.918 3.316"
+      style="
+        fill: #00b8e3;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m103.9 158.482-1.909 3.332-5.093-5.487-2.58-7.797v-.004h3.838"
+      style="
+        fill: #33c6e9;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M94.322 148.526h-.003v.003l-1.918 3.322-1.925-3.307 1.952-3.386 5.728-9.92h3.834"
+      style="
+        fill: #008aaa;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M115.42 158.481h11.611l-.007-19.93h-11.605z"
+      style="
+        fill: #d4d4d4;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M115.42 148.554v9.93h11.59v-9.93z"
+      style="
+        fill: #919191;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M101.992 161.817h-3.836l-5.755-9.966 1.918-3.321z"
+      style="
+        fill: #00b8e3;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m117.333 148.526-7.669 13.289c-.705-1.036-1.913-3.331-1.913-3.331l5.753-9.959z"
+      style="
+        fill: #008aaa;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="m113.495 161.815-3.831-.001 7.67-13.288 1.917-3.317 1.921 3.34m-3.839-.023h-3.828l-5.755-9.973 1.905-3.314 4.658 5.922z"
+      style="
+        fill: #00b8e3;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+    <path
+      d="M119.25 145.205v.003l-1.917 3.318-7.677-13.286 3.841.002z"
+      style="
+        fill: #33c6e9;
+        fill-opacity: 1;
+        fill-rule: nonzero;
+        stroke: none;
+        stroke-width: 0.330729;
+      "
+      transform="translate(-82.815 -128.588)"
+    />
+  </svg>
+</template>
diff --git a/argilla-frontend/components/features/login/components/OAuthLoginButton.vue b/argilla-frontend/components/features/login/components/OAuthLoginButton.vue
index 3f906066e9..5abef5a68a 100644
--- a/argilla-frontend/components/features/login/components/OAuthLoginButton.vue
+++ b/argilla-frontend/components/features/login/components/OAuthLoginButton.vue
@@ -1,11 +1,18 @@
 <template>
   <BaseButton class="sign-in-button" @click="$emit('click')">
+    <KeycloakLogo v-if="provider === 'keycloak'" />
     {{ signinText }}
   </BaseButton>
 </template>
+
 <script>
+import KeycloakLogo from "./KeycloakLogo.vue";
+
 export default {
   name: "OAuthLoginButton",
+  components: {
+    KeycloakLogo,
+  },
   props: {
     provider: {
       type: String,
diff --git a/argilla-frontend/translation/de.js b/argilla-frontend/translation/de.js
index 98f1ddf4c7..22973a098f 100644
--- a/argilla-frontend/translation/de.js
+++ b/argilla-frontend/translation/de.js
@@ -118,7 +118,7 @@ export default {
   button: {
     ignore_and_continue: "Ignorieren und fortfahren",
     login: "Anmelden",
-    signin_with_provider: "Anmeldung bei {provider} starten",
+    signin_with_provider: "Mit {provider} anmelden",
     "hf-login": "Mit Hugging Face anmelden",
     sign_in_with_username: "Mit Benutzername anmelden",
     cancel: "Abbrechen",
diff --git a/argilla-server/src/argilla_server/api/handlers/v1/oauth2.py b/argilla-server/src/argilla_server/api/handlers/v1/oauth2.py
index 0e16f07e28..7c77296013 100644
--- a/argilla-server/src/argilla_server/api/handlers/v1/oauth2.py
+++ b/argilla-server/src/argilla_server/api/handlers/v1/oauth2.py
@@ -20,7 +20,7 @@
 from argilla_server.contexts import accounts
 from argilla_server.database import get_async_db
 from argilla_server.errors.future import NotFoundError
-from argilla_server.models import User
+from argilla_server.models import User, UserRole, Workspace, WorkspaceUser
 from argilla_server.security.authentication.oauth2 import OAuth2ClientProvider
 from argilla_server.security.authentication.userinfo import UserInfo
 from argilla_server.security.settings import settings
@@ -61,14 +61,46 @@ async def get_access_token(
     if not userinfo.username:
         raise RuntimeError("OAuth error: Missing username")
 
-    user = await User.get_by(db, username=userinfo.username)
-    if user is None:
-        user = await accounts.create_user_with_random_password(
+    user_w_workspace = await accounts.get_user_by_username(db, username=userinfo.username)
+    if user_w_workspace is None:
+        exs_workspaces = await accounts.list_workspaces(db)
+        exs_workspaces = [w.name for w in exs_workspaces]
+        default_available_workspaces = [workspace.name for workspace in settings.oauth.allowed_workspaces]
+        workspaces = userinfo.available_workspaces or default_available_workspaces
+        # Check first if workspaces exist
+        workspaces = [w for w in workspaces if w in exs_workspaces]
+
+        user_w_workspace = await accounts.create_user_with_random_password(
             db,
             username=userinfo.username,
             first_name=userinfo.first_name,
+            last_name=userinfo.last_name,
             role=userinfo.role,
-            workspaces=[workspace.name for workspace in settings.oauth.allowed_workspaces],
+            workspaces=workspaces,
         )
+    else:
+        # With existing user update the role if needed
+        if user_w_workspace.role != userinfo.role:
+            user_w_workspace = await user_w_workspace.update(db, role=userinfo.role)
+        # With existing user update the workspaces if needed
+        if user_w_workspace.role != UserRole.owner and set(user_w_workspace.workspaces) != set(
+            userinfo.available_workspaces
+        ):
+            for workspace_name in userinfo.available_workspaces:
+                workspace = await Workspace.get_by(db, name=workspace_name)
+                if not workspace:
+                    continue
+
+                await WorkspaceUser.create(
+                    db,
+                    workspace_id=workspace.id,
+                    user_id=user_w_workspace.id,
+                    autocommit=False,
+                )
+            for workspace in user_w_workspace.workspaces:
+                if workspace.name not in userinfo.available_workspaces:
+                    ws_user = await WorkspaceUser.get_by(db, workspace_id=workspace.id, user_id=user_w_workspace.id)
+                    await ws_user.delete(db, autocommit=False)
+            await db.commit()
 
-    return Token(access_token=accounts.generate_user_token(user))
+    return Token(access_token=accounts.generate_user_token(user_w_workspace))
diff --git a/argilla-server/src/argilla_server/security/authentication/oauth2/_backends.py b/argilla-server/src/argilla_server/security/authentication/oauth2/_backends.py
index a663034ae3..93b6f72f11 100644
--- a/argilla-server/src/argilla_server/security/authentication/oauth2/_backends.py
+++ b/argilla-server/src/argilla_server/security/authentication/oauth2/_backends.py
@@ -13,7 +13,7 @@
 #  limitations under the License.
 
 import os
-from typing import Type, Dict, Any
+from typing import Type, Dict, Any, Optional, List
 
 from social_core.backends.oauth import BaseOAuth2
 from social_core.backends.open_id_connect import OpenIdConnectAuth
@@ -21,6 +21,7 @@
 from social_core.strategy import BaseStrategy
 
 from argilla_server.errors.future import NotFoundError
+from argilla_server.models import UserRole
 
 
 class Strategy(BaseStrategy):
@@ -48,6 +49,61 @@ class HuggingfaceOpenId(OpenIdConnectAuth):
     DEFAULT_SCOPE = ["openid", "profile"]
 
 
+class KeycloakOpenId(OpenIdConnectAuth):
+    """Huggingface OpenID Connect authentication backend."""
+
+    name = "keycloak"
+
+    def oidc_endpoint(self) -> str:
+        value = super().oidc_endpoint()
+
+        if value is None:
+            from social_core.utils import setting_name
+
+            name = setting_name("OIDC_ENDPOINT")
+            raise ValueError(
+                "oidc_endpoint needs to be set in the Keycloak configuration. "
+                f"Please set the {name} environment variable."
+            )
+
+        return value
+
+    def get_user_details(self, response: Dict[str, Any]) -> Dict[str, Any]:
+        user = super().get_user_details(response)
+
+        if role := self._extract_role(response):
+            user["role"] = role
+
+        if available_workspaces := self._extract_available_workspaces(response):
+            user["available_workspaces"] = available_workspaces
+
+        return user
+
+    def _extract_role(self, response: Dict[str, Any]) -> Optional[str]:
+        roles = self._read_realm_roles(response)
+        role_to_value = {UserRole.owner: 3, UserRole.admin: 2, UserRole.annotator: 1}
+        role_list = [role.split(":")[1] for role in roles if role.startswith("argilla_role:")]
+        if role_list:
+            max_role = max(role_list, key=lambda s: role_to_value.get(s, 0))
+            return max_role
+
+    def _extract_available_workspaces(self, response: Dict[str, Any]) -> List[str]:
+        roles = self._read_realm_roles(response)
+
+        workspaces = []
+        for role in roles:
+            if role.startswith("argilla_workspace:"):
+                workspace = role.split(":")[1]
+                workspaces.append(workspace)
+
+        return workspaces
+
+    @classmethod
+    def _read_realm_roles(cls, response) -> List[str]:
+        realm_access = response.get("realm_access") or {}
+        return realm_access.get("roles") or []
+
+
 _SUPPORTED_BACKENDS = {}
 
 
@@ -56,6 +112,7 @@ def load_supported_backends(extra_backends: list = None) -> Dict[str, Type[BaseO
 
     backends = [
         "argilla_server.security.authentication.oauth2._backends.HuggingfaceOpenId",
+        "argilla_server.security.authentication.oauth2._backends.KeycloakOpenId",
         "social_core.backends.github.GithubOAuth2",
         "social_core.backends.google.GoogleOAuth2",
     ]
diff --git a/argilla-server/src/argilla_server/security/authentication/userinfo.py b/argilla-server/src/argilla_server/security/authentication/userinfo.py
index 70173cda7e..266acd2097 100644
--- a/argilla-server/src/argilla_server/security/authentication/userinfo.py
+++ b/argilla-server/src/argilla_server/security/authentication/userinfo.py
@@ -36,11 +36,19 @@ def username(self) -> str:
     def first_name(self) -> str:
         return self.get("first_name") or self.username
 
+    @property
+    def last_name(self) -> str:
+        return self.get("last_name") or ""
+
     @property
     def role(self) -> UserRole:
         role = self.get("role") or self._parse_role_from_environment()
         return UserRole(role)
 
+    @property
+    def available_workspaces(self) -> Optional[list]:
+        return self.get("available_workspaces")
+
     def _parse_role_from_environment(self) -> Optional[UserRole]:
         """This is a temporal solution, and it will be replaced by a proper Sign up process"""
         if self["username"] == os.getenv("USERNAME"):
diff --git a/argilla-server/tests/unit/api/handlers/v1/test_oauth2.py b/argilla-server/tests/unit/api/handlers/v1/test_oauth2.py
index 76bc4c6b4c..be29523c40 100644
--- a/argilla-server/tests/unit/api/handlers/v1/test_oauth2.py
+++ b/argilla-server/tests/unit/api/handlers/v1/test_oauth2.py
@@ -19,13 +19,14 @@
 from httpx import AsyncClient
 from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy.orm import selectinload
 
 from argilla_server.enums import UserRole
 from argilla_server.errors.future import AuthenticationError
 from argilla_server.models import User
 from argilla_server.security.authentication import JWT
 from argilla_server.security.authentication.oauth2 import OAuth2Settings
-from tests.factories import AdminFactory, AnnotatorFactory
+from tests.factories import AdminFactory, AnnotatorFactory, WorkspaceFactory
 
 
 @pytest.fixture
@@ -110,6 +111,40 @@ async def test_provider_huggingface_access_token(
                 assert user is not None
                 assert user.role == UserRole.annotator
 
+    async def test_provider_access_token_with_specific_userinfo_workspace(
+        self,
+        async_client: AsyncClient,
+        db: AsyncSession,
+        owner_auth_header: dict,
+        default_oauth_settings: OAuth2Settings,
+    ):
+        workspace = await WorkspaceFactory.create()
+
+        with mock.patch("argilla_server.security.settings.Settings.oauth", new_callable=lambda: default_oauth_settings):
+            with mock.patch(
+                "argilla_server.security.authentication.oauth2.provider.OAuth2ClientProvider._fetch_user_data",
+                return_value={"username": "username", "name": "name", "available_workspaces": [workspace.name]},
+            ):
+                response = await async_client.get(
+                    "/api/v1/oauth2/providers/huggingface/access-token",
+                    params={"code": "code", "state": "valid"},
+                    headers=owner_auth_header,
+                    cookies={"huggingface_oauth2_state": "valid"},
+                )
+
+                assert response.status_code == 200
+
+                json_response = response.json()
+                assert JWT.decode(json_response["access_token"])["username"] == "username"
+                assert json_response["token_type"] == "bearer"
+
+                user = await db.scalar(
+                    select(User).options(selectinload(User.workspaces)).filter_by(username="username")
+                )
+                assert user is not None
+                assert user.role == UserRole.annotator
+                assert user.workspaces == [workspace]
+
     async def test_provider_huggingface_access_token_with_missing_username(
         self,
         async_client: AsyncClient,
diff --git a/argilla-server/tests/unit/security/authentication/oauth2/backends/__init__.py b/argilla-server/tests/unit/security/authentication/oauth2/backends/__init__.py
new file mode 100644
index 0000000000..4b6cecae7f
--- /dev/null
+++ b/argilla-server/tests/unit/security/authentication/oauth2/backends/__init__.py
@@ -0,0 +1,14 @@
+#  Copyright 2021-present, the Recognai S.L. team.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
diff --git a/argilla-server/tests/unit/security/authentication/oauth2/backends/test_keycloack_backend.py b/argilla-server/tests/unit/security/authentication/oauth2/backends/test_keycloack_backend.py
new file mode 100644
index 0000000000..c542abf771
--- /dev/null
+++ b/argilla-server/tests/unit/security/authentication/oauth2/backends/test_keycloack_backend.py
@@ -0,0 +1,114 @@
+#  Copyright 2021-present, the Recognai S.L. team.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+from argilla_server.security.authentication.oauth2._backends import KeycloakOpenId, Strategy
+
+
+class TestKeyCloackOpenIdBackend:
+    def test_get_user_details_with_argilla_role(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2", "argilla_role:annotator"]},
+            }
+        )
+
+        assert user_details["role"] == "annotator"
+
+    def test_get_user_details_with_wrong_argilla_role_definition(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2", "argilla_role=annotator"]},
+            }
+        )
+
+        assert "role" not in user_details
+
+    def test_get_user_details_without_argilla_role(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2"]},
+            }
+        )
+
+        assert "role" not in user_details
+
+    def test_get_user_details_with_argilla_workspaces(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2", "argilla_workspace:ws1"]},
+            }
+        )
+
+        assert user_details["available_workspaces"] == ["ws1"]
+
+    def test_get_user_details_with_wrong_argilla_workspace_definition(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2", "argilla_workspace=ws1"]},
+            }
+        )
+
+        assert "available_workspaces" not in user_details
+
+    def test_get_user_details_with_multiple_argilla_workspaces(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2", "argilla_workspace:ws1", "argilla_workspace:ws2"]},
+            }
+        )
+
+        assert user_details["available_workspaces"] == ["ws1", "ws2"]
+
+    def test_get_user_details_with_missing_argilla_workspaces(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"roles": ["role1", "role2"]},
+            }
+        )
+
+        assert "available_workspaces" not in user_details
+
+    def test_get_user_details_with_missing_roles_key(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details(
+            {
+                "realm_access": {"other": "stuff"},
+            }
+        )
+
+        assert "role" not in user_details
+        assert "available_workspaces" not in user_details
+
+    def test_get_user_details_with_missing_realm_access_key(self):
+        backend = KeycloakOpenId(strategy=Strategy())
+
+        user_details = backend.get_user_details({"other": "stuff"})
+
+        assert "role" not in user_details
+        assert "available_workspaces" not in user_details
diff --git a/argilla/docs/reference/argilla-server/sso_keycloak.md b/argilla/docs/reference/argilla-server/sso_keycloak.md
new file mode 100644
index 0000000000..9d88d7a874
--- /dev/null
+++ b/argilla/docs/reference/argilla-server/sso_keycloak.md
@@ -0,0 +1,190 @@
+# SSO Integration Keycloak
+
+## Set-up Keycloak
+
+To test this run a test version of Keycloak in Docker:
+
+```bash
+docker run -p 8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:26.0.5 start-dev
+```
+
+General steps:
+1. create a new realm and a new client to use with Argilla.
+2. The client should expose the client audience via userinfo.
+3. After that add the users you want to have access to argilla.
+
+The script below should do all of that for you to test. It needs one python dependency you can install with `pip install python-keycloak`.
+
+
+```python
+from keycloak import KeycloakAdmin
+from keycloak import KeycloakOpenIDConnection
+from keycloak import KeycloakOpenID
+
+ARGILLA_CLIENT_ID = "argilla-client"
+ARGILLA_REALM = "argilla"
+
+keycloak_connection = KeycloakOpenIDConnection(
+    server_url="http://localhost:8080/",
+    username="admin",
+    password="admin",
+    realm_name="master",
+    client_id="admin-cli",
+)
+
+keycloak_admin = KeycloakAdmin(connection=keycloak_connection)
+
+keycloak_admin.create_realm(
+    {
+        "realm": ARGILLA_REALM,
+        "enabled": True,
+        "displayName": "Argilla",
+        "userManagedAccessAllowed": True,
+    }
+)
+keycloak_connection = KeycloakOpenIDConnection(
+    server_url="http://localhost:8080/",
+    username="admin",
+    password="admin",
+    user_realm_name="master",
+    realm_name=ARGILLA_REALM,
+)
+
+keycloak_admin = KeycloakAdmin(connection=keycloak_connection)
+
+client = keycloak_admin.create_client(
+    {
+        "clientId": ARGILLA_CLIENT_ID,  # The client ID (you can choose a name)
+        "enabled": True,
+        "protocol": "openid-connect",  # Protocol (you can use other protocols like 'saml' if needed)
+        "publicClient": False,  # Set to False if the client will use client secrets
+        "directAccessGrantsEnabled": True,
+        "standardFlowEnabled": True,
+        "frontchannelLogout": True,
+        "secret": "client-secret",  # Set a secret if it's not a public client
+        "redirectUris": [
+            "http://localhost:3000/*",
+            "http://localhost:6900/*",
+        ],  # Redirect URIs after authentication
+    }
+)
+
+keycloak_openid = KeycloakOpenID(server_url="http://localhost:8080/",
+                                 client_id=ARGILLA_CLIENT_ID,
+                                 realm_name=ARGILLA_REALM)
+
+public_key = keycloak_openid.public_key()
+
+client_scope = keycloak_admin.create_client_scope({
+    "name": "argilla_client_scope",
+    "protocol": "openid-connect",
+    "include.in.token.scope": "true"
+})
+
+# Create Audience Mapper
+audience_mapper = keycloak_admin.add_mapper_to_client_scope(
+    client_scope_id=client_scope,
+    payload={
+    "name": "Client Audience",
+    "protocol": "openid-connect",
+    "protocolMapper": "oidc-audience-mapper",
+    "consentRequired": False,
+    "config": {
+        "included.client.audience": ARGILLA_CLIENT_ID,
+        "id.token.claim": "false",
+        "access.token.claim": "true"
+    }
+})
+# Create Realm Roles Mapper
+roles_mapper = keycloak_admin.add_mapper_to_client_scope(
+    client_scope_id=client_scope,
+    payload={
+        "name": "Realm Role Mapper",
+        "protocol": "openid-connect",
+        "protocolMapper": "oidc-usermodel-realm-role-mapper",
+        "consentRequired": False,
+        "config": {
+            "multivalued": "true",  # Indicates if the claim should support multiple values
+            "user.attribute": "",
+            "token.claim.name": "realm_access.roles",  # The claim in the token
+            "claim.name": "realm_access.roles",  # The mapped claim name
+            "jsonType.label": "String",  # Type of the claim
+            "id.token.claim": "true",  # Include in ID Token
+            "access.token.claim": "true",  # Include in Access Token
+            "userinfo.token.claim": "true"  # Include in User Info
+        }
+    }
+)
+# Create Group Membership Mapper
+group_mapper = keycloak_admin.add_mapper_to_client_scope(
+    client_scope_id=client_scope,
+    payload={
+        "name": "Group Membership Mapper",
+        "protocol": "openid-connect",
+        "protocolMapper": "oidc-group-membership-mapper",
+        "consentRequired": False,
+        "config": {
+            "multivalued": "true",  # The claim should support multiple group memberships
+            "token.claim.name": "groups",  # The claim name in the token
+            "full.path": "true",  # Include full path of groups (e.g., /parent-group/child-group)
+            "id.token.claim": "true",  # Include group membership in ID Token
+            "access.token.claim": "true",  # Include group membership in Access Token
+            "userinfo.token.claim": "true"  # Include group membership in User Info
+        }
+    }
+)
+
+keycloak_admin.add_default_default_client_scope(client_scope)
+
+new_user = keycloak_admin.create_user(
+    {
+        "email": "example@example.com",
+        "username": "example",
+        "enabled": True,
+        "firstName": "Example",
+        "lastName": "User",
+        "credentials": [
+            {
+                "value": "secret",
+                "type": "password",
+            }
+        ],
+    }
+)
+```
+
+## Set-up Argilla Server
+
+After that you need to configure you endpoints in the `.oauth.yaml` same as this is done for the HuggingFace Oauth:
+
+```yaml
+# Change to `false` to disable HF oauth integration
+#enabled: false
+
+allow_http_redirect: true
+
+providers:
+  - name: keycloak
+    client_id: <name of your client e.g. example-client>
+    client_secret: <value of your specified secret e.g. client-secret>
+    redirect_uri: http://localhost:3000/oauth/keycloak/callback # if you test locally
+  - name: huggingface
+    client_id: <create a new https://huggingface.co/settings/connected-applications>
+    client_secret: <create a new https://huggingface.co/settings/connected-applications>
+    redirect_uri: http://localhost:3000/oauth/huggingface/callback # if you test locally
+
+# Allowed workspaces must exists
+allowed_workspaces:
+  - name: default
+```
+
+Then you need to set the two environment variables:
+
+```bash
+export SOCIAL_AUTH_OIDC_ENDPOINT=http://localhost:8080/realms/argilla
+```
+
+- `http://localhost:8080` is your keycloak endpoint in this case the local docker
+- `argilla` is the name of the realm configured above
+
+