# Don't include REALM roles in SAML

**URL:** https://forum.keycloak.org/t/dont-include-realm-roles-in-saml/17570
**Category:** Getting advice
**Tags:** admin-console, saml
**Created:** [September 23, 2022, 3:18am UTC](https://forum.keycloak.org/t/dont-include-realm-roles-in-saml/17570 "2022-09-23T03:18:20Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![ssang](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@ssang](https://forum.keycloak.org/u/ssang)
#### Post date: [September 23, 2022, 3:18am UTC](https://forum.keycloak.org/t/dont-include-realm-roles-in-saml/17570/1 "2022-09-23T03:18:20Z")

</div>

I’m configuring Keycloak with AWS IAM federation. It failed because the [https://aws.amazon.com/SAML/Attributes/Role](https://aws.amazon.com/SAML/Attributes/Role) assertion includes not only my IAM role but also keycloak default realm roles as well (default-roles-master, offline\_access etc.)

How do I make it so that the assertion only include my CLIENT roles and NOT REALM roles?

I’m running Keycloak 19 and there is no “Full scope allowed” toggle for me to do this.

---

<div class="post-metadata">

### Author: ![ssang](https://avatars.discourse-cdn.com/v4/letter/s/fbc32d/32.png) [@ssang](https://forum.keycloak.org/u/ssang)
#### Post date: [September 23, 2022, 3:47am UTC](https://forum.keycloak.org/t/dont-include-realm-roles-in-saml/17570/2 "2022-09-23T03:47:57Z")

</div>

Solved it. The problem is that the USER role mappings are being sent in SAML assertion