<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 09/08/16 11:48, NEMECKAY Marek
wrote:<br>
</div>
<blockquote
cite="mid:6780F0043CD4A945B043E2484C7C53357C0F2819@vie196nt"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Dear all,</div>
<div> </div>
<div>We are facing a problem with retrieving the client roles
from Keycloak. In our implementation we are using the
following API to find a retrieve user data via username:</div>
<div><a moz-do-not-send="true"
href="http://www.keycloak.org/docs/rest-api/index.html#_get_users"><font
color="blue"><u>http://www.keycloak.org/docs/rest-api/index.html#_get_users</u></font></a></div>
</span></font></blockquote>
<font color="blue"><font size="2"><font face="Calibri"><u>It seems
that you need different admin REST endpoint to get the client
role mappings of user. It's this one : </u></font></font></font><br>
<pre>GET /admin/realms/{realm}/users/{id}/role-mappings/clients/{client}
Marek
</pre>
<blockquote
cite="mid:6780F0043CD4A945B043E2484C7C53357C0F2819@vie196nt"
type="cite"><font face="Calibri" size="2"><span
style="font-size:11pt;">
<div> </div>
<div>In the retrieved <a moz-do-not-send="true"
href="http://www.keycloak.org/docs/rest-api/index.html"><font
color="blue"><u>UserRepresentation</u></font></a> object
instance the property clientRoles is always null. We are
using Keycloak 1.9.8 connected to a LDAP server for user
federation. We are connecting a receiving the access token
with a admin-user of the corresponding realm. This works
just fine. We are also receiving user data like name, e-mail
etc., but the client roles are always null. The mappers to
sync roles between Keycloak
and LDAP are also defined and working. </div>
<div> </div>
<div>Is there anything else we have overlooked or we should
check?</div>
<div> </div>
<div>Thanks and BR,</div>
<div>Marek</div>
<div> </div>
</span></font>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>