title: how to get the roles in access token: keycloak
body: <p>what I am trying to do:</p>
  
  <ol>
  <li><p>I have an app that takes in login credentials: username and password for a user. I  have a rest api that internally calls the keycloak REST API: /auth/realms/realmname/protocol/openid-connect/token
  and gets the access token for this user.</p></li>
  <li><p>Now I am building another REST API to access a resource where I want to do the following:
  doSomething(accesstoken, data)</p>
  
  <p>{</p>
  
  <p>a) <code>call keycloak API to validate access token and get roles.</code></p>
  
  <p>b) if role ==  manager, process(data)</p>
  
  <p>c) else: return error msg.</p>
  
  <p>}</p></li>
  </ol>
  
  <p>Now, how do I do (a): validating the access token and getting the roles associated with it.
  I know we can do: auth/realms/realmname/protocol/openid-connect/userinfo
  but that only gives the details about the user like name, email, etc. but does not display any roles.
  Here's an example I got:</p>
  
  <pre><code>{
      "name": "test user",
      "sub": "e2bad34d-a1a9-4d70-ac84-bd3a3246023e",
      "email_verified": false,
      "preferred_username": "user",
      "given_name": "test",
      "family_name": "user"
  }
  </code></pre>
  
  <p>As seen, it doesnt give the roles at all. How do I then tell what roles this access token has? Interestingly, when I search for this, many resources are suggesting the above userinfo endpoint. But this merely tells me taht the access token I provided is valid. Does not give roles for that.
  In other words - it authenticates but does not authorize.</p>
  
  <p>Please suggest.</p>
  
  <p>Thanks,
  Anand</p>