Re: [keycloak-user] Update roles at login time between 2 realms

So here is a bit more of context regarding why I am doing this and trying to achieve. // Short version We have application where we would like to allow an "admin" customer user to add other users of his company with some roles, but not some specific roles that would be reserved for us. So far, we only overcame that by creating 2 realms. // Longer version Actually, the client of realm A is going to be an application where all users of my company need to have access, and with full rights (basically this is an application for administrating and configuring application of realm B). Client of realm B is going to be an application used by a given customer of ours. Initially, we would create a single user on this realm B, with "admin rights" on users for this realm. So this customer admin will be able to manage the users of this customer realm, change roles, and so forth. This customer admin user will also have a role CUSTOMER_ADMIN on this realm B. The use case we are trying to solve is : we need to be able to give to this "customer admin of realm B user" a limited access to the application of realm A. (So that our customer is able to manage part of his application, but not all of it). This limited access on application of realm A would be granted only if the user has role CUSTOMER_ADMIN on realm B. Now so far, first time this customer admin user connects to the application of realm A, this creates a user in realm A, with the CUSTOMER_ADMIN role on realm A if it was found on realm B, thanks to a role importer mapper. But let's say this CUSTOMER_ADMIN role is removed by us on realm B for this user, or this CUSTOMER_ADMIN role is given to another user on realm B, we need to sync the roles on realm A so that is has or no longer has access to application on realm A. I have no clue if this is a trivial use case of not, and if the way we thought this is correct way to do, but any input will be much appreciated! Thanks a lot! Le 05/20/2016 02:53 PM, Bill Burke a écrit :