Scopes for my frontend and external client

Securing applications
1

Hi,

I have a scenario
I want external public clients to be able to authenticate with keycloak and get access tokens
The tokens have scopes in them e.g scope"openid email read:inventory"
I have created a resource server with certain authorities like hasAuthority(“SCOPE_read:inventory”)

It all works fine.

If I want to also authenticate with keycloak from my own internal front-end client,
do I also have to include these scopes in the access token for my front-end client or is there a way to just give the user all the scopes anytime they are authenticating from my front-end client.

2

I’m not sure there is a way to tell Keycloak to just include ALL available scopes as default for a client. You’ll need to specify.

1 Like
3

Thank you for your response