That's already the case. Users inherit all attributes from the group. You need to add a protocol mapper to pull new attributes into the token though. Open your client in the admin console: * Click on mappers * Create * Mapper type: user attribute * Fill in name and token claim name with whatever you want. Select a suitable json type. Click on Add to access token and/or Add to ID token * User Attribute: name of the attribute in the group * Save Now relogin to your app and the token should have the new claim in it. On 19 September 2016 at 15:43, Uli SE <keycloaklist(a)ulise.de&gt; wrote: