# SAML response Role Attribute containing (unexpected?) AttributeValue roles

**URL:** https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196
**Category:** Getting advice
**Tags:** saml
**Created:** [April 16, 2020, 5:26pm UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196 "2020-04-16T17:26:25Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![anitabee](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/anitabee/32/681_2.png) [@anitabee](https://forum.keycloak.org/u/anitabee)
#### Post date: [April 16, 2020, 5:26pm UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196/1 "2020-04-16T17:26:25Z")

</div>

Hi all,

I’m using Keycloak 9.0.2 and trying to set up SSO for AWS using SAML client protocol.  
I’ve configured SAML aws client, role for this client and few mappers.  
But if I configure mapper type `Role List` as in pic bellow:

 ![session_role](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/e3f56a2afabfc25417202c190c78394d251dcdcf.png)

I am seeing all realm roles in SAML response being mapped, e.g.: SAML response:

```xml
<saml:Attribute FriendlyName="Session Role" Name="https://aws.amazon.com/SAML/Attributes/Role"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
        manage-events
    </saml:AttributeValue>
    <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema"
                         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">
        manage-realm
    </saml:AttributeValue>
...
</saml:Attribute>

```

I was expecting that only roles for this client would be mapped? Am I doing something wrong or is this expected?

---

<div class="post-metadata">

### Author: ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)
#### Post date: [April 16, 2020, 6:31pm UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196/2 "2020-04-16T18:31:55Z")

</div>

My guess you have enabled realm roles.  
`Role list` mapper is wrong approach, because you need those roles in the specific format. Scripted mapper will be better option. See

> <https://stackoverflow.com/questions/56077875/transforming-ldap-group-memberships-to-saml-attributes-in-keycloak>

---

<div class="post-metadata">

### Author: ![anitabee](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/anitabee/32/681_2.png) [@anitabee](https://forum.keycloak.org/u/anitabee)
#### Post date: [April 16, 2020, 8:53pm UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196/3 "2020-04-16T20:53:10Z")

</div>

I have `Role Name Mapper` which is mapping needed role in that specific format correctly, but will try your suggestion, ty

---

<div class="post-metadata">

### Author: ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)
#### Post date: [April 17, 2020, 5:19am UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196/4 "2020-04-17T05:19:57Z")

</div>

That’s interesting. Where did you store your roles in that specific AWS format? LDAP, Keycloak?

Scripted mapper doesn’t help you with unwanted. You need to have disabled realm roles (`Full Scope Allowed: Off`), maybe the are defined/assigned as client roles.

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/f81eca6c45e95c77e6fd8ef75a251eb24fc4cc95.png)

---

<div class="post-metadata">

### Author: ![anitabee](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/anitabee/32/681_2.png) [@anitabee](https://forum.keycloak.org/u/anitabee)
#### Post date: [April 19, 2020, 6:23pm UTC](https://forum.keycloak.org/t/saml-response-role-attribute-containing-unexpected-attributevalue-roles/2196/5 "2020-04-19T18:23:25Z")

</div>

> That’s interesting. Where did you store your roles in that specific AWS format? LDAP, Keycloak?

I’ve stored it in `Role Name Mapper` so in Keycloak. I had one custom Role which I’ve connected to this mapper. I know hackish but I just wanted to make it work somehow. But anyhow as I do need to create roles based on LDAP groups your suggestion for scripted mapper was what I needed.

> Scripted mapper doesn’t help you with unwanted. You need to have disabled realm roles ( `Full Scope Allowed: Off` ), maybe the are defined/assigned as client roles.

That was indeed issue for unwanted roles.

Thank you for help!