Map differend ldap-groups

[xundeenergie]

I've configured in my ldap (where the users and groups/roles come from in my ldap) for each application/client roles with such a pattern:
perm-app-_users
perm-app-_admins

And i've a mapper in keycloak for those ldap-groups to create and assign them as roles for my users.

How can i map such roles with patterns to the client-role "restricted-access"?

Or can i configure the access-provider with a wildcard/pattern?
Is it possible with something like
spi-restrict-client-auth-access-provider-client-role-client-role-name=perm-app-${clientid}_*

[sventorben]

Are your roles perm-app-_users and perm-app-_admins per client or are these realm roles?

[sventorben]

Forget about my question. Try the following:

Add a client role "restricted-access" to each app/client. Then convert your perm-app-_users and perm-app-_admins roles to composite roles that include the restricted-access role of the corresponding app/client.

See video vor details:

Recording.2024-02-20.103600.1.mp4

[sventorben]

@xundeenergie does this work for you?

[xundeenergie]

yes, it works for me.
Thank you!!