I have two custom roles I need to assign to the users ROLE_USER and ROLE_CLIENT.
And there are 2 clients A and B.
The goal is to assign roles to users automatically, depending on what auth type they used.
ROLE_USER is a created as a realm role, any user inherits it. (implicitly both client A and B)
ROLE_CLIENT is added as a client role to a specific client (client B).
Both role types are mapped to role scope and included in ID token.
For the users authenticated via any client I’m able to see ROLE_USER in token/UI.
But users authenticated via client B don’t have ROLE_CLIENT assigned. Token section ‘resource_access’ (with default structure resource_access.${client_id}.roles) doesn’t even have client Id section, only ‘account’ is there.
Based on tips I see in UI I’d expect role ROLE_CLIENT be present in the user roles / token once the user is authenticated via client B.
Am I missing any concept?
KC Version 21.1.1 (docker latest)