# Advanced Claim to Role Regex

**URL:** <https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026>\
**Category:** Getting advice\
**Created:** [August 22, 2022, 3:03pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026 "2022-08-22T15:03:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![belfhi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/belfhi/32/1690_2.png) [@belfhi](https://forum.keycloak.org/u/belfhi)\
**Post date:** [August 22, 2022, 3:03pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026/1 "2022-08-22T15:03:09Z")

</div>

Hi,  
I’d like to map an OIDC claim to a Realm Role.  
If I use the `advanced claim to role` mapper with the exact  
value of the clami it works as expected.

Now, I want to make it more general and use a RegEx to map multiple  
claim values to this group but this does not work.  
My claim is `eduperson_entitlement` and I would like to map any claim value of `urn:geant:helmholtz.de:group:` and anything that follows to this to my role.  
How do I construct the RegEx?  
It seems like I’m missing somethng, a simple search for \b does not work.  
Does anyone have experience with this?  
Cheers

---

<div class="post-metadata">

**Author:** ![alansonsci](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/alansonsci/32/7609_2.png) [@alansonsci](https://forum.keycloak.org/u/alansonsci)\
**Post date:** [February 2, 2023, 2:24pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026/2 "2023-02-02T14:24:37Z")

</div>

Did you make any progress with this?

---

<div class="post-metadata">

**Author:** ![belfhi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/belfhi/32/1690_2.png) [@belfhi](https://forum.keycloak.org/u/belfhi)\
**Post date:** [February 6, 2023, 7:57pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026/3 "2023-02-06T19:57:16Z")

</div>

Hi @alansonsci ,  
yes, I had to match the _whole_ of the OIDC Claim with a regex matchall  
`(\b<MATCH>\b)(?s)(.*$)`  
This worked. Took a while and a lot of [regex101.com](http://regex101.com) 😃

---

<div class="post-metadata">

**Author:** ![alansonsci](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/alansonsci/32/7609_2.png) [@alansonsci](https://forum.keycloak.org/u/alansonsci)\
**Post date:** [March 13, 2023, 11:38pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026/4 "2023-03-13T23:38:19Z")

</div>

BTW did you write a script to do this or was it via the console? I am trying to learn about the REST API and trying and failing to get it working via my python script. [import requestsimport jsonimport boto3# Set up variables for Keycloak se - Pastebin.com](https://pastebin.com/aCNBEU7B)

---

<div class="post-metadata">

**Author:** ![belfhi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/belfhi/32/1690_2.png) [@belfhi](https://forum.keycloak.org/u/belfhi)\
**Post date:** [March 15, 2023, 12:43pm UTC](https://forum.keycloak.org/t/advanced-claim-to-role-regex/17026/5 "2023-03-15T12:43:11Z")

</div>

hi,  
no I just used the Web UI.