title: Keycloak and Vault Integration with Client Role
body: <p>I am trying to integrate Keycloak with Vault. I have 2 Vault policies (Admin, Dev). I want to use a path 'keycloak', and have done <code>$ vault auth enable -path=keycloak oidc</code>.</p>
  <p>The problem I want to solve, is to map Vault Policy with the Keycloak Client Role.</p>
  <pre><code>$ vault write auth/keycloak/config \
    oidc_discovery_url=&quot;https://$KEYCLOAK_ADDRESS/auth/realms/master&quot; \
    oidc_client_id=&quot;vault&quot; \
    oidc_client_secret=${CLIENT_SECRET} \
    default_role=&quot;admin&quot; type=&quot;oidc&quot;
  
  $ vault write auth/keycloak/role/admin \
      bound_audiences=&quot;vault&quot; \
      allowed_redirect_uris=&quot;https://$VAULT_ADDRESS/ui/vault/auth/oidc/oidc/callback&quot; \
      allowed_redirect_uris=&quot;https://localhost:8250/oidc/callback&quot; \
      user_claim=&quot;sub&quot; \
      policies=&quot;admin&quot; \
      ttl=4h \
      role_type=&quot;oidc&quot; \
      oidc_scopes=&quot;openid&quot;
  
  $ vault write auth/keycloak/role/dev \
      bound_audiences=&quot;vault&quot; \
      allowed_redirect_uris=&quot;https://$VAULT_ADDRESS/ui/vault/auth/oidc/oidc/callback&quot; \
      allowed_redirect_uris=&quot;https://localhost:8250/oidc/callback&quot; \
      user_claim=&quot;sub&quot; \
      policies=&quot;dev&quot; \
      ttl=4h \
      role_type=&quot;oidc&quot; \
      oidc_scopes=&quot;openid&quot;
  </code></pre>
  <p>I want admin and dev roles in Vault bound to &quot;vault&quot; client in Keycloak. However, according to the group that the user is bounded to, I want the user to have different policy. (Both login via console with <code>vault login -method=oidc keycloak</code>)</p>
  <p>Have any ideas? The solution I have in mind is to make 2 different client. However, I want only 1 client 'vault'. Can this be achieved?</p>