Realm Group Roles in userinfo endpoint (v25.0.0)

Getting advice
1

I created a Realm.
In the Realm I created a Client
In the Client I created two roles, let’s call them Admin and Worker.
In the Realm I created two groups - an Admin group with the Admin role, and a Worker group with the Worker role.
I created a user and assigned them to both groups, so they should have both Client roles.

I created a Client Scope: “openid”, made sure it was active for the userinfo and access token endpoints, and gave it a User Client Role mapper. I added made sure that the openid scope was enabled as Default for the Client I had created.

I’m authenticating against Keycloak using spring security (v6.2).
When it auths it gets a USER_ OPENID token which has all the various claims, but no mention of the roles I assigned to that user via the groups.

What am I doing wrong? Do group roles (albeit Client Roles) not get mapped using the User Client Role mapping?

2

Turns out adding the openid client scope does diddly squat.
What I actually needed to do was go to the existing “roles” Client scope, enable it for the token scope and change the client roles mapper for it so that it was enabled for the userinfo endpoint.

1 Like