Why the buildin claims not shown in JWT from the default client “admin-cli” in Keycloak?

Question

In keycloak, there is a default client which client id is “admin-cli”. I try to add a buildin claim into this client.

In Mappers tab under this client, I add buildin mapper “realm roles”. But when I get the JWT from this client using the API:

http://{{url}}/auth/realms/{{realm}}/protocol/openid-connect/token

with proper client_id, the JWT doesn’t include the claim.

I created another client and add the same mapper with same configuration, JWT requested from that client includes the claim.

Any idea why the claim not shown in JWT from client “admin-cli” ?

Answer 1

Any idea why the claim not shown in JWT from client “admin-cli” ?

Old Keycloak UI

Yes, you need to:

• Go Master Realm;
• Clients;
• Click on Admin-cli;
• Switch to Scope;
• In admin-cli Scope Mappings: Set Full Scope Allowed to ON.

This will make all the Realm and Client roles to show up on the Token. If you only need some specific roles then do the following:

• Go Master Realm;
• Clients;
• Click on Admin-cli;
• Switch to Scope;
• In admin-cli Scope Mappings:
• Select the Realm Roles (or client roles) and move then to Assigned Roles column.

---

New Keycloak UI

Yes, you need to:

• Go Master Realm;
• Clients;
• Click on Admin-cli;
• Switch to Client Scopes;
• Click on admin-cli-dedicated;
• Switch to Scope
• Set Full Scope Allowed to ON.

This will make all the Realm and Client roles to show up on the Token. If you only need some specific roles then do the following:

• Go Master Realm;
• Clients;
• Click on Admin-cli;
• Switch to Client Scopes;
• Click on admin-cli-dedicated;
• Switch to Scope
• Click on the Assign Role button
• Select the Realm Roles (or client roles) and then click assign