Keycloak Client Role Mapper / User Role Mapper multivalued roles rendering

readme.md

AccessToken with client role mapper and realm role mapper set to multivalue: "false"

{
  "jti": "4320f052-138a-47da-a5bc-1be47cfc5060",
  "exp": 1487009587,
  "nbf": 0,
  "iat": 1487009287,
  "iss": "http://localhost:8081/auth/realms/token-mapper-test",
  "aud": "dummy",
  "sub": "a4487df9-fd40-4ffe-8163-5fd05f86b959",
  "typ": "Bearer",
  "azp": "dummy",
  "auth_time": 0,
  "session_state": "9d04185c-64eb-40b3-905e-24c62c285e90",
  "acr": "1",
  "client_session": "c2a41e1e-27f3-4a7a-a3f7-a419b4711cfc",
  "allowed-origins": [],
  "realm_access": {
    "roles": [
      "admin",
      "uma_authorization",
      "user"
    ]
  },
  "resource_access": {
    "dummy": {
      "roles": [
        "dummyadmin",
        "dummyuser"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "view-profile"
      ]
    }
  },
  "realm_roles": "[offline_access, admin, uma_authorization, user]",
  "client_roles": "[dummyadmin, dummyuser]",
  "name": "Theo Tester",
  "preferred_username": "tester",
  "given_name": "Theo",
  "family_name": "Tester",
  "email": "tom+tester@tdlabs.local"
}

AccessToken with client role mapper and realm role mapper set to multivalue: "true"

{
  "jti": "12fd0ada-0908-4d19-8a86-63d64befbc7c",
  "exp": 1487009486,
  "nbf": 0,
  "iat": 1487009186,
  "iss": "http://localhost:8081/auth/realms/token-mapper-test",
  "aud": "dummy",
  "sub": "a4487df9-fd40-4ffe-8163-5fd05f86b959",
  "typ": "Bearer",
  "azp": "dummy",
  "auth_time": 0,
  "session_state": "3162474e-4ccc-4ec4-860d-c719f3b41b29",
  "acr": "1",
  "client_session": "29aa7a2e-d7d5-4b6e-904a-ca85392bf93f",
  "allowed-origins": [],
  "realm_access": {
    "roles": [
      "admin",
      "uma_authorization",
      "user"
    ]
  },
  "resource_access": {
    "dummy": {
      "roles": [
        "dummyadmin",
        "dummyuser"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "view-profile"
      ]
    }
  },
  "realm_roles": [
    "offline_access",
    "admin",
    "uma_authorization",
    "user"
  ],
  "client_roles": [
    "dummyadmin",
    "dummyuser"
  ],
  "name": "Theo Tester",
  "preferred_username": "tester",
  "given_name": "Theo",
  "family_name": "Tester",
  "email": "tom+tester@tdlabs.local"
}

Just wondering if this gist was to highlight an issue I've been having...

When setting the mapper's multi value parameter to false, Keycloak's docs say "If false, just first value will be set as claim." What I was expecting, with Claim JSON Type set to String, is to have the claim set to the string name of the role i.e. "claimName" : "roleName". Instead I get "claimName": "[roleName]" with the square brackets.

I can't seem to get rid of the brackets, which is proving to be a huge frustration.

My assumption looking at this gist was that you were highlighting this issue. Did you ever find a workaround?

Cheers!