diff --git a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
index 3105afc5e8..09080540fe 100644
--- a/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
+++ b/testsuite/integration-arquillian/tests/base/src/main/java/org/keycloak/testsuite/updaters/ClientAttributeUpdater.java
@@ -136,4 +136,9 @@ public class ClientAttributeUpdater extends ServerResourceUpdater<ClientAttribut
         rep.getDefaultClientScopes().add(clientScope);
         return this;
     }
+
+    public ClientAttributeUpdater setDirectAccessGrantsEnabled(Boolean directAccessGranted) {
+        rep.setDirectAccessGrantsEnabled(directAccessGranted);
+        return this;
+    }
 }
diff --git a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
index 12050651ed..e1f3141d07 100644
--- a/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
+++ b/testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/oauth/OIDCProtocolMappersTest.java
@@ -49,6 +49,8 @@ import org.keycloak.testsuite.AssertEvents;
 import org.keycloak.testsuite.admin.ApiUtil;
 import org.keycloak.testsuite.arquillian.annotation.AuthServerContainerExclude;
 import org.keycloak.testsuite.arquillian.annotation.EnableFeature;
+import org.keycloak.testsuite.updaters.ClientAttributeUpdater;
+import org.keycloak.testsuite.updaters.ProtocolMappersUpdater;
 import org.keycloak.testsuite.util.ClientManager;
 import org.keycloak.testsuite.util.OAuthClient;
 import org.keycloak.testsuite.util.ProtocolMapperUtil;
@@ -69,6 +71,7 @@ import static org.hamcrest.Matchers.hasItems;
 import static org.hamcrest.Matchers.instanceOf;
 import static org.hamcrest.Matchers.is;
 import static org.hamcrest.Matchers.isEmptyOrNullString;
+import static org.hamcrest.Matchers.notNullValue;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
@@ -784,6 +787,43 @@ public class OIDCProtocolMappersTest extends AbstractKeycloakTest {
         deleteMappers(protocolMappers);
     }
 
+    @Test
+    public void testUserGroupRoleToAttributeMappersScopedWithDifferentClient() throws Exception {
+        final String clientId = "test-app-scope";
+        final String diffClient = "test-app";
+        final String realmName = "test";
+
+        final ProtocolMapperRepresentation realmMapper = ProtocolMapperUtil.createUserRealmRoleMappingMapper("pref.", "Realm roles mapper", "roles-custom.realm", true, true);
+        final ProtocolMapperRepresentation clientMapper = ProtocolMapperUtil.createUserClientRoleMappingMapper(diffClient, null, "Client roles mapper", "roles-custom.test-app", true, true);
+
+        try (ClientAttributeUpdater cau = ClientAttributeUpdater.forClient(adminClient, realmName, clientId).setDirectAccessGrantsEnabled(true);
+             ProtocolMappersUpdater protocolMappers = new ProtocolMappersUpdater(cau.getResource().getProtocolMappers())) {
+
+            protocolMappers.add(realmMapper, clientMapper).update();
+
+            // Login user
+            oauth.clientId(clientId);
+            OAuthClient.AccessTokenResponse response = browserLogin("password", "rich.roles@redhat.com", "password");
+            IDToken idToken = oauth.verifyIDToken(response.getIdToken());
+
+            // Verify attribute is filled
+            Map<String, Object> roleMappings = (Map<String, Object>) idToken.getOtherClaims().get("roles-custom");
+            assertNotNull(roleMappings);
+            assertThat(roleMappings.keySet(), containsInAnyOrder("realm", diffClient));
+            String realmRoleMappings = (String) roleMappings.get("realm");
+            String testAppScopeMappings = (String) roleMappings.get(diffClient);
+            assertRolesString(realmRoleMappings,
+                    "pref.admin",
+                    "pref.user",
+                    "pref.customer-user-premium"
+            );
+            assertRolesString(testAppScopeMappings,
+                    "customer-admin-composite-role",
+                    "customer-admin"
+            );
+        }
+    }
+
     @Test
     public void testGroupAttributeUserOneGroupNoMultivalueNoAggregate() throws Exception {
         // get the user