# Create a scope and assign it to a client using the keycloak admin Java SDK

**URL:** <https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901>\
**Category:** Miscellanaeous\
**Created:** [March 5, 2024, 9:02pm UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901 "2024-03-05T21:02:21Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![ndtreviv](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ndtreviv/32/9944_2.png) [@ndtreviv](https://forum.keycloak.org/u/ndtreviv)\
**Post date:** [March 5, 2024, 9:02pm UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/1 "2024-03-05T21:02:21Z")

</div>

I’m using the keycloak admin Java library to create a scope in my realm, like so:

```java
ClientScopeRepresentation openidScope = new ClientScopeRepresentation();
openidScope.setName("openid");
openidScope.setProtocol("openid-connect");
scopeResource.create(openidScope);

```

I’m then creating a Client that uses that scope:

```java
ClientRepresentation clientRepresentation...
clientRepresentation.setDefaultClientScopes(List.of("openid", ...));
realm.clients().create(clientRepresentation);

```

I can see the scope listed in the Admin Console UI under the Client Scopes section:

 ![Screenshot 2024-03-05 at 20.59.29](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/d/d00fcf2920d85c8c734dc1d2b3408a5761078684.png)

But when I go to the Client itself and look under the Scopes tab, it’s not there.

So two questions:

1. Notice that the Assigned type is `None` - I want this to be `Default`, but I can’t see a property to set on the ClientScopeRepresentation to make that happen, how do I do that?
2. How do I assign this Client Scope to the Client?

---

<div class="post-metadata">

**Author:** ![ndtreviv](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ndtreviv/32/9944_2.png) [@ndtreviv](https://forum.keycloak.org/u/ndtreviv)\
**Post date:** [March 6, 2024, 10:37am UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/2 "2024-03-06T10:37:56Z")

</div>

Looking at the Network inspector when using the admin UI, when I assign a default scope I see a single request at the point of assignment that references the scope by its ID.

So I changed my code to find `ClientScopeRepresentation`s by their names and set the default scopes to their IDs, but the association between the Client and the Client Scope still doesn’t happen.

---

<div class="post-metadata">

**Author:** ![ndtreviv](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ndtreviv/32/9944_2.png) [@ndtreviv](https://forum.keycloak.org/u/ndtreviv)\
**Post date:** [March 6, 2024, 11:24am UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/3 "2024-03-06T11:24:14Z")

</div>

Finally worked it out:

```java
realm.clientScopes().findAll().stream()
    .filter(scope -> ALL_SCOPES.contains(scope.getName()))
    .forEach(clientScopeRepresentation -> clientResource.addDefaultClientScope(clientScopeRepresentation.getId()));

```

---

<div class="post-metadata">

**Author:** ![jnspinola](https://avatars.discourse-cdn.com/v4/letter/j/7ba0ec/32.png) [@jnspinola](https://forum.keycloak.org/u/jnspinola)\
**Post date:** [March 7, 2024, 4:49pm UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/4 "2024-03-07T16:49:04Z")

</div>

Hello Nathan,

Could you please tell me which type is the variable “scopeResource” and “clientResource” in your sample code?

I am trying to use your code to create a scope through java but so far no success. Could you possibly post here a more complete sample of your code?

Thank you for your time and attention!

---

<div class="post-metadata">

**Author:** ![ndtreviv](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ndtreviv/32/9944_2.png) [@ndtreviv](https://forum.keycloak.org/u/ndtreviv)\
**Post date:** [March 11, 2024, 2:43pm UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/5 "2024-03-11T14:43:13Z")

</div>

Sure!

Here’s the full method:

```java
    void setClientScopes(RealmResource realm) {
        ClientRepresentation clientRepresentation = getClientRepresentation(realm);
        ClientResource clientResource = getClientResource(realm, clientRepresentation);
        realm.clientScopes().findAll().stream()
            .filter(scope -> Scopes.names().contains(scope.getName()))
            .forEach(clientScopeRepresentation -> {
                log.info("Adding client scope: '{}' ({}) to client", clientScopeRepresentation.getName(), clientScopeRepresentation.getId());
                clientResource.addDefaultClientScope(clientScopeRepresentation.getId());
            });
    }

```

Hope it helps! If you need anything else, let me know.

---

<div class="post-metadata">

**Author:** ![jnspinola](https://avatars.discourse-cdn.com/v4/letter/j/7ba0ec/32.png) [@jnspinola](https://forum.keycloak.org/u/jnspinola)\
**Post date:** [March 11, 2024, 3:02pm UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/6 "2024-03-11T15:02:27Z")

</div>

Thank you very much Nathan!

I will give it a try as soon as i can and report back.

---

<div class="post-metadata">

**Author:** ![jnspinola](https://avatars.discourse-cdn.com/v4/letter/j/7ba0ec/32.png) [@jnspinola](https://forum.keycloak.org/u/jnspinola)\
**Post date:** [March 13, 2024, 8:01am UTC](https://forum.keycloak.org/t/create-a-scope-and-assign-it-to-a-client-using-the-keycloak-admin-java-sdk/24901/7 "2024-03-13T08:01:47Z")

</div>

Since i only needed to add scopes to the realm and not to a client i ended up going with the code below for now:

```
public static void createScope(KeycloakSession session, String scopeName) {

    var realm = session.getContext().getRealm();

    var scopes = realm.getClientScopesStream()
        .filter(scope -> scope.getName().equals(scopeName))
        .toArray();

    if(scopes.length==0) {
        LOGGER.debug("creating client scope: scope={} to realm={}", scopeName, realm.getName());
        var newScope = realm.addClientScope(scopeName);
        newScope.setProtocol("openid-connect");
    }
}

```

Thanks again for the help Nathan!