<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Currently if you use
"use-resource-role-mappings" to true, the JEE roles (those used
for protection in security-constraints in web.xml) are used from
Application roles, otherwise from Realm roles. Currently we don't
have possibility to use both realm and application roles for that.
<br>
<br>
However the alternative is, that you can retrieve the keycloak
accessToken in your application (See our examples on how to do
that) and this accessToken will contain all the realm and
application roles of the user. This allows you to do some more
role based filtering programmatically in your application.<br>
<br>
Marek<br>
<br>
On 16.6.2015 15:58, Edem Morny wrote:<br>
</div>
<blockquote cite="mid:1434463094.4281.7.camel@localhost.localdomain"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="GENERATOR" content="GtkHTML/4.6.6">
Hi,<br>
<br>
I've created a realm, and a default role in that realm called
"user". I then created a client and added an application role to
the client. I've set "use-resource-role-mappings" to true in the
keycloak.json file inside my war file.<br>
<br>
I attempt to access a path that is protected by the role "user",
and log in with an account that has both the realm role "user" and
the application role "mdc-staff", and I'm redirected to my 403
page, meaning the "user" role didn't seem to be available to the
user. When I attempt to access a path protected by the "mdc-staff"
role, i don't get a 403, meaning that the application specific
role is available.<br>
<br>
Is there something I need to do to enable both realm and
application level roles available to the user when I login? This
is very key for us to implementing SSO for different client
secured by the same realm. I thought "Full Scopes Allowed" was not
enabled, but it was and still things don't work as expected.<br>
<br>
Cheers.<br>
<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>