Repository navigation
Replies: 1 comment
|
I did find a workaround in the client scope mapper set the client id to "realm-management" then only those roles are added to prevent a 403 on any of the realm endpoints, but would like to know if it's possible to remove the realm roles to. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
When I setup a client with lightweight tokens it works correctly on roles with policies that have fetch roles enabled see:
#27430
but if the user also has any realm-management roles keycoal will not authenticate it if the roles are not in the JWT for example if the user has view-users it can no longer access:
/auth/admin/realms/example/usersIs this a bug, or is there a way to only add
realm-managementroles in the jwt but hide other roles?All reactions