Re: [keycloak-dev] offline access permission incorrect?

I was thinking that people may have usecase, when they don't want all users to allow automatically ask for offline tokens? Currently offline_access is realm default role, so all users are automatically allowed to "request" offline tokens. But was thinking that someone may want also the opposite use-case. For example allow just admin user to request offline tokens, but ensure that other users are not allowed to request it. If you think, we can remove this capability. We can see if people claims that they want to add it back :) Nobody specifically requested that capability as it's there since the beginning of the offline tokens support. In clientScope PR, there is "offline_access" client scope, but "offline_access" realm role is also still there and it's assigned as "role scope mapping" to the offline_access clientScope. So clientScope PR still requires users to be in "offline_access" role. If you want to change the behaviour, it will be nice to do that after clientScope PR is merged, however if it blocks you, it's likely fine to do it now. The clientScope PR will then need to be updated later as there would be some conflicts... Marek Dne 3.4.2018 v 11:21 Stian Thorgersen napsal(a):