# Keycloak x 17 issue with authorization and multiple scopes

**URL:** <https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613>\
**Category:** Getting advice\
**Tags:** oidc\
**Created:** [May 18, 2022, 1:22pm UTC](https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613 "2022-05-18T13:22:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tmanolescu](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/tmanolescu/32/5502_2.png) [@tmanolescu](https://forum.keycloak.org/u/tmanolescu)\
**Post date:** [May 18, 2022, 1:22pm UTC](https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613/1 "2022-05-18T13:22:20Z")

</div>

Hello,  
Did any of you guys had this issue:  
If first scope in the resource is invalid (denied) it returns access denied, doesn’t check if second one is valid.  
If the first scope is valid and second invalid it works fine.  
The decision strategy is affirmative on permission and client.  
It doesn’t matter if the response mode is decision or permissions.  
Example:  
First request

```nohighlight
curl --location --request POST '../auth/realms/Test/protocol/openid-connect/token' \
--header 'Authorization: Bearer {access_token}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:uma-ticket' \
--data-urlencode 'audience=client' \
--data-urlencode 'permission=Resource#Invalid scope, Valid scope' \
--data-urlencode 'response_mode=decision'

```

result:

```json
{
    "error": "access_denied",
    "error_description": "not_authorized"
}

```

Second request

```nohighlight
curl --location --request POST '../auth/realms/Test/protocol/openid-connect/token' \
--header 'Authorization: Bearer {access_token}' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=urn:ietf:params:oauth:grant-type:uma-ticket' \
--data-urlencode 'audience=client' \
--data-urlencode 'permission=Resource#Valid scope, Invalid scope' \
--data-urlencode 'response_mode=decision'

```

result:

```json
{
    "result": true
}

```

---

<div class="post-metadata">

**Author:** ![tmanolescu](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/tmanolescu/32/5502_2.png) [@tmanolescu](https://forum.keycloak.org/u/tmanolescu)\
**Post date:** [May 25, 2022, 8:30am UTC](https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613/2 "2022-05-25T08:30:45Z")

</div>

ok …so no one had this issue?

---

<div class="post-metadata">

**Author:** ![Gagan](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@Gagan](https://forum.keycloak.org/u/Gagan)\
**Post date:** [October 12, 2022, 6:17am UTC](https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613/3 "2022-10-12T06:17:47Z")

</div>

Facing Same issue with keycloak-18.0.1. If same user is added to first permission it gives scopes for both permissions but doesnt work if it is not in first permission

---

<div class="post-metadata">

**Author:** ![to.hsingh](https://avatars.discourse-cdn.com/v4/letter/t/d26b3c/32.png) [@to.hsingh](https://forum.keycloak.org/u/to.hsingh)\
**Post date:** [October 13, 2022, 6:10am UTC](https://forum.keycloak.org/t/keycloak-x-17-issue-with-authorization-and-multiple-scopes/15613/4 "2022-10-13T06:10:06Z")

</div>

@ [tmanolescu](http://forum.keycloak.org/u/tmanolescu)

Are you able to fix this?