# Resource\_access claim missing from userinfo - until I change the name?

**URL:** <https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238>\
**Category:** Getting advice\
**Tags:** oidc\
**Created:** [February 12, 2020, 12:04pm UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238 "2020-02-12T12:04:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![fahr](https://avatars.discourse-cdn.com/v4/letter/f/d26b3c/32.png) [@fahr](https://forum.keycloak.org/u/fahr)\
**Post date:** [February 12, 2020, 12:04pm UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238/1 "2020-02-12T12:04:33Z")

</div>

Hello all,

I just ran into the most peculiar issue. While debugging some OIDC client I ran a few manual requests on keycloak using curl. When I called the userinfo endpoint, I noticed there was no resource\_access claim, despite it being in the client scopes, with the client roles -\> add to user info turned on.

After a whole lot of trial and error and googling, I accidentally found out that if I change the claim name from resource\_access.${client\_id}.roles to ANYTHING ELSE, the claim IS included.

I changed it to resource\_access2.{client\_id}.roles, for instance, and it was instantly there. I changed it to resource\_access.x.{client\_id}.roles and it was there as well. Only with the claim name resource\_access.${client\_id}.roles does it not appear.

Did I stumble upon an obscure bug here, or am I missing something obvious?

---

<div class="post-metadata">

**Author:** ![viZu](https://avatars.discourse-cdn.com/v4/letter/v/ea5d25/32.png) [@viZu](https://forum.keycloak.org/u/viZu)\
**Post date:** [February 21, 2020, 2:07pm UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238/2 "2020-02-21T14:07:42Z")

</div>

Same here, we are using keycloak 7.3.0.GA with the same result.

If I change the claim name resource\_access.${client\_id}.roles the userinfo endpoint returns the claim, otherwise not.

I’ve tried different things like adding the “roles” scope to the access token, without success.

Did anyone made this work? Help is much appreciated 🙂

---

<div class="post-metadata">

**Author:** ![mposolda](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mposolda/32/12_2.png) [@mposolda](https://forum.keycloak.org/u/mposolda)\
**Post date:** [February 21, 2020, 3:44pm UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238/3 "2020-02-21T15:44:51Z")

</div>

This looks like a bug. Feel free to create JIRA. If you have a chance to  
send PR with the fix, it will be even better 🙂

Thanks,  
Marek

---

<div class="post-metadata">

**Author:** ![gitdode](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/gitdode/32/1178_2.png) [@gitdode](https://forum.keycloak.org/u/gitdode)\
**Post date:** [July 15, 2020, 11:00pm UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238/4 "2020-07-15T23:00:40Z")

</div>

I have the same issue with 9.0.0, with adding realm\_access.roles to userinfo.

Has a JIRA issue been created already? I could give it a try and debug it.

Cheers,  
Torsten

---

<div class="post-metadata">

**Author:** ![sebastienm](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/sebastienm/32/295_2.png) [@sebastienm](https://forum.keycloak.org/u/sebastienm)\
**Post date:** [August 5, 2020, 9:47am UTC](https://forum.keycloak.org/t/resource-access-claim-missing-from-userinfo-until-i-change-the-name/1238/5 "2020-08-05T09:47:51Z")

</div>

Same issue here using keycloak 10

seems there is this jira : [https://issues.redhat.com/browse/KEYCLOAK-9874](https://issues.redhat.com/browse/KEYCLOAK-9874)