<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Look at the "scope" tab for particular
client in admin console. You need to uncheck "Full scope allowed"
and then select requested scopes. The resulting roles in the token
are the intersection of user's roles + client's scoped roles. <br>
<br>
Marek<br>
<br>
On 13/09/16 08:48, Andy Yar wrote:<br>
</div>
<blockquote
cite="mid:CAMBdEykHeQoMEEaxF34We5d9LCb47pX8Knxut9W5fRO9EEkXAA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>
<div>
<div>
<div>Hello,<br>
</div>
I'm wondering, is there a way how to restrict certain
clients in a realm for a given user?<br>
<br>
</div>
Of course, I can map roles to user and check them in each
application. However, it seems like it might be easier to
perform directly on Keycloak side.<br>
<br>
</div>
What is the correct way how to achieve that?<br>
<br>
</div>
Thanks in advance.<br>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<p><br>
</p>
</body>
</html>