Returning Realm Roles in Token

1

Hi,

I added a User Realm Role Mapper to the off-the-shelf /account Client. When I print out the token, I see resource_access which returns the correct (default) roles for the client. However, I don’t see a realm_access section when I log in to /account.

I used Add Builtin to hook the Realm Role Mapper to the client.

I’m running 18 in dev mode and restarted a few times. Is there a setting I’m missing to put this Mapper into effect?

Thanks,
Carl

2

I’ve tried a few Scope settings too like “Full Scope Allowed” and moving all the roles to the assigned list.

3

My test case is as follows. I tried this on KC 17 and 18

  1. Create a realm
  2. Create a user
  3. On the Client “Account”, add a User Realm Roles Mapper
  4. On the Client “Account”, set Full Scope Allowed
  5. Log on to Client “Account”
  6. Print the token
  7. Verify that there is no realm_access section

I also created a Realm Role “myrole” and add it to the user to see if maybe the defaults were deliberately not sent.

4

I also cleared the cache and verified that the realm_access section shows up in the Client Scopes / Evaluate / Generated Access Token tab. The token shown in the console does not have the same fields as what I get from the POST /token call.

5

heh. Mixed up the clients. I was troubleshooting account when the token was based on account-console. Adding Full Scope Allowed to this client worked.