How to get access token with roles for specific client?

user_7881247 0
Viewed 289

I have setup similar to this in keycloak:

  • Client:
    • frontend (public, getting token from this client)
    • backend1 (confidential)
    • backend2 (confidential)
  • Client scope:
    • roles_all (to include users' roles for each client in the token)
    • roles_backend1 (to include only roles for backend1)
    • roles_backend2 (to include only roles for backend2)

What I need is to only get roles for specific clients instead of all clients in the token. I made it work by adding a Client scope (roles_backendX) for each client and sending scopes in the token request but I am wondering if there is a simpler way. For example request the roles_all scope but with a specified client eg. scope=roles_all:backend1 or scope=roles_all.backend1

Something like that would save me a lot of manual setup.

EDIT: (ideallly)

  • Client:
    • frontend (public, getting token from this client)
    • backend1 (confidential)
    • backend2 (confidential)
  • Client scope:
    • roles_all (optional)

and login with something like: auth.server.com/realms/SomeRealm/protocol/openid-connect/auth?response_type=code&clientid=frontend&scope=roles_all:backend1 roles_all:backend2...

keycloak access-token openid-connect
1 Answers

1.) Clients should have Full Scope Allowed disabled

2.) Then you can play with mappers/scope config (e.g. User Realm role mapper type) or with client scope (abstraction for group of mappers - you can configure them as assigned default scopes, so you won't need to specify them explictily in the token request)

user_33486040
Related