# Creating "super-roles" from LDAP

**URL:** <https://forum.keycloak.org/t/creating-super-roles-from-ldap/17561>\
**Category:** Miscellanaeous\
**Created:** [September 22, 2022, 5:01pm UTC](https://forum.keycloak.org/t/creating-super-roles-from-ldap/17561 "2022-09-22T17:01:10Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![mfriedenhagen](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mfriedenhagen/32/6383_2.png) [@mfriedenhagen](https://forum.keycloak.org/u/mfriedenhagen)\
**Post date:** [September 22, 2022, 5:01pm UTC](https://forum.keycloak.org/t/creating-super-roles-from-ldap/17561/1 "2022-09-22T17:01:10Z")

</div>

Hello,

in the LDAP tree of my user federation, I have so called roles with member attributes:

```auto
dn: uid=21579852,ou=roles,o=foo,o=example,c=com
objectClass: organizationalUnit
cn: myrolename
uid: 21579852
member: uid=u1,ou=users,ou=foo,o=example,c=com
member: uid=u2,ou=users,ou=foo,o=example,c=com
member: uid=u3,ou=users,ou=foo,o=example,c=com

```

I now may easily map LDAP-cn myrolename to roles or groups in Keycloak. Now I want to do some aggregation based on an object which is called `spRightObject`, the attribute `uid` is the same in both objects:

```auto
dn: righttypeid=2001673,uid=21579852,ou=roles,o=foo,o=example,c=com
righttypeid: 2001673
objectClass: top
objectClass: spRightObject
uid: 21579852
rightname: system1
rightname: system2
rightname: system3

```

I now want to somehow achieve, that only groups or maybe roles with the rightname system1 are able to use a certain client. What would be the best approach here?

Thanks for answers in advance  
Mirko