Hello,

I’m mailing here as I found a bug, but I’m not sure if it’s an expected result.

According to the documentation (https://keycloak.gitbooks.io/server-adminstration-guide/content/topics/groups.html)

Then, I assume that if I assign a role to a group, and it appears in the ‘Effective Roles’ tab of the group, any user inside of the group will inherit the roles.

The problem: I’ve been testing with a simple OpenID Connect client in confidential mode, and the user doesn’t have any of this roles (I exposed Role as a mapper using User Realm Role mapper) and fetched the roles using an OIDC client.

However, if I assign the roles directly to the user, the roles are returned as expected, in the User Info endpoint.

Is it possible that there is a bug in the group system that is not giving the proper roles to the underneath users?

Thanks a lot for your time, and have a nice week!