[keycloak-user] Role based Policy, User token forbidden from entitlement API

I have users in my realm that I have assigned realm roles to: realm roles: Master, Apprentice one such user is test_user roles: uma_authorization, Apprentice When I enable authorization on a client and 1. add a resource besides the default resource to it, say "Second Resource" 2. under Policies - Roles a role-based policy referencing the realm role Apprentice that my user belongs to Using the test user’s acess_token gotten from the realm token endpoint: curl -X POST \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_id=admin-cli&username=test_user&password=password&grant_type=password" \ https://mykeycloak.domain/auth/realms/myrealm/protocol/openid-connect/token and checking the entitlement API response for the client’s id and using the bearer access token of the user as well as the payload for the Second Resource, I always get status code forbidden curl -v -X POST \ -H "Content-Type:application/json" \ -H 'Authorization: bearer userbearerrertoken' \ -d '{"permissions":[{"resource_set_name:"Second Resource"}]}' \ https://mykeycloak.domainauth/realms/myrealm/authz/entitlement/my_client_id For the Default Resource, all is fine and I get back an RPT. Am I missing something regarding the user’s needed roles? According to the documentation, the role-level permission for the Second Resource should lead to the user being authorized to access the second resource if any realm role in a role-based permission for a resource holds. I am using keycloak 2.5.1.