Re: [keycloak-user] Getting Permissions from RPT

Hi, I am evaluating keycloak and trying out the following scenario: The system has a resource 1. "Contact" and two client roles 1. Admin 2. Trainee The "Admin role" can create, view, edit and delete the "contact resource" The "Trainee Role" can create and view "contact resource" Followed the following steps to setup the resource server: 1. Created a resource "Contact" 2. Created scopes "create, view, edit and delete" 3. Created role based policy with Admin Role - "Contact Admin Policy" 4. Created role based policy with Trainee Role - "Contact Trainee Policy" 4. Created Scope based permission "Contact Admin Permission" with all the scopes (Create, View, Edit, Delete) and associated it the "contact Admin policy" 5. Created Scope based permission "Contact Trainee Permission" with create and view scopes and associated it with the "Contact Trainee Policy" After this setup, using the following Authz client code, trying to display the permission associated with the user AuthzClient authzClient = AuthzClient.create(); String accessToken = authzClient.obtainAccessToken("UserName", "UserPassword").getToken(); EntitlementResponse response = authzClient.entitlement(accessToken).getAll("Client ID"); String rpt = response.getRpt(); TokenIntrospectionResponse requestingPartyToken = authzClient.protection().introspectRequestingPartyToken(rpt); System.out.println("Token status is: " + requestingPartyToken.getActive()); System.out.println("Permissions granted by the server: "); for (Permission granted : requestingPartyToken.getPermissions()) { System.out.println(granted); } For admin I get: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Edit, Contact:Delete]} where as the expected is: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View, Contact:Edit, Contact:Delete]} For Trainee I get - Nothing where as the expected is: Permission {id=778e76d4-dc06-4e98-a213-fd7f22975ab7, name=Contact, scopes=[Contact:Create, Contact:View]} Would you please let me know what I am doing wrong or how to setup resource server to get the expected output. Thanks -Chandran