title: SpringBoot OAuth2 with Keycloak not returning mapped Roles as Authorities
body: <p>I am creating a simple SpringBoot application and trying to integrate with OAuth 2.0 provider Keycloak. I have created a realm, client, roles (Member, PremiumMember) at realm level and finally created users and assigned roles (Member, PremiumMember).</p>
  <p>If I use SpringBoot Adapter provided by Keycloak <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#_spring_boot_adapter" rel="nofollow noreferrer">https://www.keycloak.org/docs/latest/securing_apps/index.html#_spring_boot_adapter</a> then when I successfully login and check the Authorities of the loggedin user I am able to see the assigned roles such as Member, PremiumMember.</p>
  <pre class="lang-java prettyprint-override"><code>Collection&lt;? extends GrantedAuthority&gt; authorities = 
   SecurityContextHolder.getContext().getAuthentication().getAuthorities();
  </code></pre>
  <p>But if I use generic SpringBoot Auth2 Client Config I am able to login but when I check the Authorities it always show only <strong>ROLE_USER, SCOPE_email,SCOPE_openid,SCOPE_profile</strong>  and didn't include the roles I mapped (Member, PremiumMember).</p>
  <p>My SpringBoot OAuth2 config:</p>
  <p><strong>pom.xml</strong></p>
  <pre><code>&lt;dependency&gt;
    &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
    &lt;artifactId&gt;spring-boot-starter-oauth2-client&lt;/artifactId&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p><strong>application.properties</strong></p>
  <pre><code>spring.security.oauth2.client.provider.spring-boot-thymeleaf-client.issuer-uri=http://localhost:8181/auth/realms/myrealm
  
  spring.security.oauth2.client.registration.spring-boot-thymeleaf-client.authorization-grant-type=authorization_code
  spring.security.oauth2.client.registration.spring-boot-thymeleaf-client.client-id=spring-boot-app
  spring.security.oauth2.client.registration.spring-boot-thymeleaf-client.client-secret=XXXXXXXXXXXXXX
  spring.security.oauth2.client.registration.spring-boot-thymeleaf-client.scope=openid,profile,roles
  spring.security.oauth2.client.registration.spring-boot-thymeleaf-client.redirect-uri=http://localhost:8080/login/oauth2/code/spring-boot-app
  </code></pre>
  <p>I am using <strong>SpringBoot 2.5.5</strong> and <strong>Keycloak 15.0.2</strong>.</p>
  <p>Using this generic OAuth2.0 config approach (without using Keycloak SpringBootAdapter) is there a way to get the assigned roles?</p>