# SPI Question: Missing Client from resource\_access

**URL:** https://forum.keycloak.org/t/spi-question-missing-client-from-resource-access/16065
**Category:** Securing applications
**Created:** [June 21, 2022, 12:12pm UTC](https://forum.keycloak.org/t/spi-question-missing-client-from-resource-access/16065 "2022-06-21T12:12:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Carl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carl/32/10443_2.png) [@Carl](https://forum.keycloak.org/u/Carl)
#### Post date: [June 21, 2022, 12:12pm UTC](https://forum.keycloak.org/t/spi-question-missing-client-from-resource-access/16065/1 "2022-06-21T12:12:14Z")

</div>

Hi,

I’m on Keycloak 18.

I’m successfully getting a token from the [http://localhost:8080/realms/jdbcrealm/protocol/openid-connect/token](http://localhost:8080/realms/jdbcrealm/protocol/openid-connect/token) endpoint. However, it seems to be missing some client roles. When I go to the Generated Access Token tab for the user, I get this

```auto
  "resource_access": {
    "realm-management": {
      "roles": [
        "query-users"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  }

```

But when I print out the generated token from the web service call, I get this

```auto
"resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  }

```

It’s missing the info from the realm-management client.

My configuration is the out-of-the-box realm-management and a client that I created with the public/direct access for use in ReadyAPI. I’m using my created client as the client ID in the /token call.

Thanks,  
Carl

---

<div class="post-metadata">

### Author: ![Carl](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/carl/32/10443_2.png) [@Carl](https://forum.keycloak.org/u/Carl)
#### Post date: [June 21, 2022, 7:07pm UTC](https://forum.keycloak.org/t/spi-question-missing-client-from-resource-access/16065/2 "2022-06-21T19:07:23Z")

</div>

This is probably related to a custom User Storage Federation SPI that I’m working on. I haven’t been able to reproduce with a non-federated user and client.

It seems like I’m missing the clientRoleMappings. I tried a few forms of the User Adapter that rely on the super class methods but the generated token only as the “account” resource\_access.