The Single Role Attribute wasn't working

1

I just trying to use SAML as SSO from an app, and configure a client using the mappers “Role” and turn on the field “Single Role Attribute” that means i can just attach two or more roles to an user and when user login on app the attribute statement must following the example bellow:

<saml:Attribute Name=“Role”
NameFormat=“urn:oasis:names:tc:SAML:2.0:attrname-format:basic”
>
<saml:AttributeValue xmlns:xs=“defaultlink”
xmlns:xsi=“defaultlink”
xsi:type=“xs:string”
>role1, role2</saml:AttributeValue>

But it presents aways two separated value like this:

<saml:Attribute Name=“Role”
NameFormat=“urn:oasis:names:tc:SAML:2.0:attrname-format:basic”
>
<saml:AttributeValue xmlns:xs=“defaultlink”
xmlns:xsi=“defaultlink”
xsi:type=“xs:string”
>role1</saml:AttributeValue>

<saml:Attribute Name=“Role”
NameFormat=“urn:oasis:names:tc:SAML:2.0:attrname-format:basic”
>
<saml:AttributeValue xmlns:xs=“defaultlink”
xmlns:xsi=“defaultlink”
xsi:type=“xs:string”
>role2</saml:AttributeValue>

Someone knows how fix or made this working as expected?

This is how i configure my role mapper.

Captura de Tela 2024-06-18 às 11.56.10

Thanks in advance

2

Very late response but just in case it might help anyone in the future.

I managed to get the role list working by removing the role_list client scope from my client, or by setting it as optional. Keycloak automatically sets role_list as a default client scope, so my guess is that it conflicts with whatever role list we define ourselves.