# How to extend user roles from external source

**URL:** <https://forum.keycloak.org/t/how-to-extend-user-roles-from-external-source/19833>\
**Category:** Extending the server\
**Created:** [January 24, 2023, 1:30pm UTC](https://forum.keycloak.org/t/how-to-extend-user-roles-from-external-source/19833 "2023-01-24T13:30:35Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![kkcmadhu](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/kkcmadhu/32/7545_2.png) [@kkcmadhu](https://forum.keycloak.org/u/kkcmadhu)\
**Post date:** [January 25, 2023, 4:41pm UTC](https://forum.keycloak.org/t/how-to-extend-user-roles-from-external-source/19833/3 "2023-01-25T16:41:49Z")

</div>

> [@pjmalandrino](#):
>
> to keycloak base (using admin API)
> 
> Regards

i pretty much have same question, posted here [Is there a way to convert saml assertion to token claims without storing them as role/group or user attribute](http://forum.keycloak.org/t/is-there-a-way-to-convert-saml-assertion-to-token-claims-without-storing-them-as-role-group-or-user-attribute/19866)

There is something called userSession mapper in saml/oidc identity provider mapper, and user session note mapper in client scopes… i am thinking of exploring that combination to check if it will work.

but , the time out (user session timeout), etc could be challenging… not sure if it will work.

---

_[View the full topic](https://forum.keycloak.org/t/how-to-extend-user-roles-from-external-source/19833)._