# Spring-Boot, KeyCloak adapter and customized scopes

**URL:** <https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641>\
**Category:** Securing applications\
**Tags:** oidc\
**Created:** [June 18, 2021, 4:55am UTC](https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641 "2021-06-18T04:55:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![braendi](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@braendi](https://forum.keycloak.org/u/braendi)\
**Post date:** [June 18, 2021, 4:55am UTC](https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641/1 "2021-06-18T04:55:44Z")

</div>

According to the docs ([Securing Applications and Services Guide](https://www.keycloak.org/docs/latest/securing_apps/index.html#_java_adapter_config)), there is no way to use a customized scopes list with KeyCloak adapter. Am I missing something or is that true? So I have to omit the client adapter and do a customized security configuration?

---

<div class="post-metadata">

**Author:** ![nmwael](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/nmwael/32/3232_2.png) [@nmwael](https://forum.keycloak.org/u/nmwael)\
**Post date:** [June 21, 2021, 6:07am UTC](https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641/2 "2021-06-21T06:07:07Z")

</div>

Do you mean for certain users to have access if they have a special scope?

AFAIK it’s just done in the configuration as you mention:

> <https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-springboot/src/main/java/org/keycloak/quickstart/springboot/config/SecurityConfig.java>

---

<div class="post-metadata">

**Author:** ![braendi](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@braendi](https://forum.keycloak.org/u/braendi)\
**Post date:** [June 21, 2021, 6:54am UTC](https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641/3 "2021-06-21T06:54:52Z")

</div>

Our KeyCloak is configured to return additional information in the ID-Token when a given scope is requested. The standard client adapter for KeyCloak only requests` openid` scope:

`https://keycloak.my.com/auth/realms/myrealm/protocol/openid-connect/auth?response_type=code&client_id=my-client-id&redirect_uri=https://...&state=...&login=true&scope=openid`

Is there a simple property I can set, so that a custom scope is additionaly requested, such as:

`keycloak.scopes=openid, myadditionalscope`

to achieve this:

`https://keycloak.my.com/auth/realms/myrealm/protocol/openid-connect/auth?response_type=code&client_id=my-client-id&redirect_uri=https://...&state=...&login=true&scope=openid, myadditionalscope`

---

<div class="post-metadata">

**Author:** ![braendi](https://avatars.discourse-cdn.com/v4/letter/b/bbe5ce/32.png) [@braendi](https://forum.keycloak.org/u/braendi)\
**Post date:** [June 22, 2021, 5:00am UTC](https://forum.keycloak.org/t/spring-boot-keycloak-adapter-and-customized-scopes/9641/4 "2021-06-22T05:00:25Z")

</div>

Ahhh, my bad. Though I don’t request the additional scope, I get it’s information anyway - in the access token (I first checked only the id token). Nonetheless, and though it’s not necessary any more, I managed to pass the special scope, by overriding KeyCloaks OAuthRequestAuthenticator.