title: How to get Authorization (permissions) in keycloak JWT?
body: <p><strong>Objective</strong>: I am trying to add authorization details to the JWT using a custom mapper for Keycloak, so that when a user logs in using the login page, his token will also contain all the permissions that are applicable.
  As an example, here's the following code (decoded from the JWT):</p>
  
  <pre><code>"authorization": {
      "permissions": [
        {
          "scopes": [
            "edit",
            "buy"
          ],
          "rsid": "af23b104-1d7e-41ab-7600-6d5bb405ad8e",
          "rsname": "Custom Resource"
        }
      ]}
  </code></pre>
  
  <p>To be more specific, I'm trying to obtain a similar result as if using grant_type=urn:ietf:params:oauth:grant-type:uma-ticket, but directly from the default Keycloak login page.</p>
  
  <p><strong>What I tried</strong>: I tried making a custom mapper based on this example: <a href="https://github.com/mschwartau/keycloak-custom-protocol-mapper-example" rel="nofollow noreferrer">https://github.com/mschwartau/keycloak-custom-protocol-mapper-example</a> </p>
  
  <p>I looked in the base code of Keycloak, but there doesn't seem to be any way to include authorization data in the tokens using the default behaviour. From what I could find, the data might be in the KeycloakPrincipal, but I am not sure if this is true, because there doesn't seem to be a way to obtain that. I might be mistaken, though, since I'm not very experienced with Keycloak.</p>
  
  <p>As a side note, using the grant_type=urn:ietf:params:oauth:grant-type:uma-ticket in a rest call works, but it is not an acceptable solution, unfortunately.</p>