Some pointers for you: - If you want offline token, you need to attach "scope=offline_access" when you send request to the secured URL of your application. Server-side adapter will then automatically re-send the content of scope parameter to Keycloak server, which will then know that it should issue an offline token. For example if you send request to "http://your-host/your-app/secured?scope=offline_access" then Keycloak adapter will automatically resend "scope=offline_access" to the Keycloak server. - We have some docs for offline tokens and the example in examples distribution in "preconfigured-demo/offline-access-app" - If your role has "Scope param required" set to ON in Keycloak server, then it is added to the token just if you use it in scope parameter. So for example if you attach scope parameter like "scope=borg_cube", then role "borg_cube" will be used for the token. - ATM there is no builtin possibility to have just one or the other through scope parameter. So if you use "scope=borg_cube quantum_singularity" then your token will contain both those roles. You may need to implement custom protocolMapper if you want such requirement that either just one or the other is used. Or somehow handle it in your app (eg. if accessToken has both roles, then throw an error or something. Looks like workaround, but maybe the easiest path for you). Another possibility is, that you want use scope parameter at all, but you will use 2 different clients - one for "borg_cube" and second for "quantum_singularity". First client will have scope (tab "Scope" in the client in KC admin console) just to invoke the "borg_cube" and second just to invoke "quantum_singularity" . But this would mean that you will need 2 separate clients on KC side for one application, which looks like workaround too. Also maybe authorization services can help you. Anyway, there are bunch of things you can try. You can decide the best path according your requirements. Hope something is helpful for you :) Marek On 20/04/17 13:52, Peter K. Boucher wrote: