<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>A better question is, why are you using 2 realms and creating the
same user in each?<br>
</p>
<br>
<div class="moz-cite-prefix">On 5/20/16 5:22 AM, Thibault Vernadat
wrote:<br>
</div>
<blockquote cite="mid:573ED749.6060601@quartetfs.com" type="cite">
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
Hello,<br>
<br>
What I am trying to achieve is the following : <br>
<br>
I have two realms with one client each. Let's call them realm A
and realm B.<br>
<br>
Users from realm B can access my application of realm A, because I
added realm B as a keycloak openid connect identity provider in
realm A.<br>
<br>
First time a user from real B access my realm A client, this
creates a user in realm A for this client, and I map some roles
for this client. <br>
<br>
So far so good. My issue now is : let's say my client initially
had a role R in realm B, and at first login this role was mapped
for this user in realm A, if the realm B admin remove role R from
this user, I want this role to be removed as well in realm A. Or
added if a new role that should be mapped was added.<br>
<br>
Is there a way to update roles next time this user try to
authenticate in the realm A app ? Or should I use another
mechanism to keep my roles consistent between my realms ?<br>
<br>
Thanks a lot in advance for your help.
<div dir="ltr">
<div class="gmail_signature">
<div dir="ltr"><br>
<p style="background:white"><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#222222"
lang="EN-GB"></span><span
style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#222222"></span></p>
</div>
</div>
</div>
<div class="moz-signature"> </div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>