Maybe it will help to use "use-resource-role-mappings" switch in your application adapter configuration (in file keycloak.json). If it won't help, then I would doublecheck if roles are present in the access token. It's possible that you need to add those roles as "scope" for your client as well. Unless your client has "Full scope allowed" on. Marek On 07/04/17 12:38, JiJesH V U wrote: