Add consumer group section, add plugin example

Signed-off-by: Diana <[email protected]>

Author: cloudjumpercat

app/_kong_plugins/openid-connect/examples/consumer-group-auth.yaml

@@ -0,0 +1,39 @@
+title: Consumer Group authorization
+description: |
+  Configure Consumer Group mapping with the OpenID Connect plugin.
+  
+extended_description: |
+  Configure Consumer Group mapping with the OpenID Connect plugin.
+  
+  This example uses password authentication, but you can use any supported [authentication type](/plugins/openid-connect/reference/#schema--config-auth-methods) with Consumer Groups.
+
+  {% include_cached plugins/oidc/client-auth.md %}
+
+weight: 849
+
+requirements:
+  - A configured identity provider (IdP)
+  - At least one [Consumer Group](/gateway/entities/consumer-group/) with a name matching the value defined in `config.consumer_group_claim`
+min_version: 3.12
+config:
+  issuer: ${issuer}
+  auth_methods:
+    - client_credentials
+  consumer_group_claim:
+    - tier
+
+variables:
+  issuer:
+    value: $ISSUER
+    description: |
+      The issuer authentication URL for your IdP. 
+      For example, if you're using Keycloak as your IdP, the issuer URL looks like this: `http://localhost:8080/realms/example-realm`
+
+tools:
+  - deck
+  - admin-api
+  - konnect-api
+  - kic
+  - terraform
+
+group: authorization

app/_kong_plugins/openid-connect/index.md

@@ -282,6 +282,7 @@ The OpenID Connect plugin has several options for performing coarse-grained auth
 1. [Claims-based authorization](#claims-based-authorization)
 2. [ACL plugin authorization](#acl-plugin-authorization)
 3. [Consumer authorization](#consumer-authorization)
+4. [Consumer Group authorization](#consumer-group-authorization) {% new_in 3.12 %}
 
 #### Claims-based authorization
 
@@ -401,6 +402,15 @@ Set up Consumer auth:
 * [Plugin configuration example](/plugins/openid-connect/examples/consumer-auth/)
 * [Consumer auth tutorial with Keycloak](/how-to/configure-oidc-with-consumers/)
 
+#### Consumer Group authorization {% new_in 3.12 %}
+
+You can use {{site.base_gateway}} [Consumer Groups](/gateway/entities/consumer-group/) for authorization and dynamically map claim values to Consumer Groups. 
+This means that we restrict the access to only those that do have a matching Consumer Group. 
+
+Set up Consumer Group auth:
+* [Plugin configuration example](/plugins/openid-connect/examples/consumer-group-auth/)
+* [Consumer Group auth tutorial with Keycloak](/how-to/configure-oidc-with-consumers/) ????
+
 ### Client authentication
 
 #### Mutual TLS client authentication