From 5e340356e76a8ef917ef3bfc2e548915f527d093 Mon Sep 17 00:00:00 2001 From: mposolda Date: Thu, 25 Oct 2018 21:59:06 +0200 Subject: [PATCH] KEYCLOAK-8175 Client scopes permissions --- server_admin/topics/clients/client-scopes.adoc | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/server_admin/topics/clients/client-scopes.adoc b/server_admin/topics/clients/client-scopes.adoc index 6a4683993d..df8518d82d 100644 --- a/server_admin/topics/clients/client-scopes.adoc +++ b/server_admin/topics/clients/client-scopes.adoc @@ -131,6 +131,17 @@ To see an example of a real access token, generated for the particular user and value of `scope` parameter, select the user from the `Evaluate` screen. This will generate an example token that includes all of the claims and role mappings used. +==== Client Scopes Permissions + +When issuing tokens for a particular user, the client scope is applied only if the user is permitted to use it. In the case that +a client scope does not have any role scope mappings defined on itself, then each user is automatically permitted to use this +client scope. However, when a client scope has any role scope mappings defined on itself, then the user must be a member of at least +one of the roles. In other words, there must be an intersection between the user roles and the roles of the client scope. Composite +roles are taken into account when evaluating this intersection. + +If a user is not permitted to use the client scope, then no protocol mappers or role scope mappings will be used when generating tokens +and the client scope will not appear in the _scope_ value in the token. + ==== Realm Default Client Scopes The `Realm Default Client Scopes` allow you to define set of client scopes, which will be automatically linked to newly created clients.