# keycloak\_client\_rolemapping does nothing?

**URL:** <https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012>\
**Category:** Ansible Project\
**Created:** [August 19, 2022, 5:27pm UTC](https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012 "2022-08-19T17:27:45Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![M\_Foster](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@M\_Foster](https://forum.ansible.com/u/M_Foster)\
**Post date:** [August 19, 2022, 5:27pm UTC](https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012/1 "2022-08-19T17:27:45Z")

</div>

I’m trying to map client roles to Keycloak groups using the keycloak\_client\_rolemapping module, but everytime I run it even with the simplest config it returns the following:

“end\_state”: {},

“msg”: "Nothing to do, roles [{‘name’: ‘test-role1’, ‘id’: ‘79026951-da5e-43f8-91de-bb0b03c298aa’}] are correctly mapped with group mygroup. " yet in the Keycloak UI under the group I am trying to map, the client role shows as “Available” not “Assigned”.

Am I missing something? (FWIW, I haven’t been able to figure out how to do this using the REST API either).

Example task in playbook:

- name: Create client role mappings  
local\_action:  
module: community.general.keycloak\_client\_rolemapping  
auth\_client\_id: admin-cli  
auth\_keycloak\_url: “{{ KEYCLOAK\_AUTH\_URL }}”  
auth\_realm: “{{ KEYCLOAK\_REALM }}”  
auth\_username: “{{ KEYCLOAK\_API\_USER }}”  
auth\_password: “{{ KEYCLOAK\_API\_PASSWORD }}”  
realm: “{{ KEYCLOAK\_REALM }}”  
state: “present”  
client\_id: “myclient”  
group\_name: “mygroup”  
roles:
- name: “test-role1”

---

<div class="post-metadata">

**Author:** ![M\_Foster](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@M\_Foster](https://forum.ansible.com/u/M_Foster)\
**Post date:** [August 19, 2022, 5:45pm UTC](https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012/2 "2022-08-19T17:45:50Z")

</div>

Oh, I wonder if “id” is also required?

---

<div class="post-metadata">

**Author:** ![M\_Foster](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@M\_Foster](https://forum.ansible.com/u/M_Foster)\
**Post date:** [August 19, 2022, 5:51pm UTC](https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012/3 "2022-08-19T17:51:07Z")

</div>

I added an “id” to the “roles:” dictionary, but now get an error “TypeError: ‘NoneType’ object is not subscriptable”, so its not clear what values I’m supposed to be using here.

---

<div class="post-metadata">

**Author:** ![M\_Foster](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@M\_Foster](https://forum.ansible.com/u/M_Foster)\
**Post date:** [August 19, 2022, 8:27pm UTC](https://forum.ansible.com/t/keycloak-client-rolemapping-does-nothing/37012/4 "2022-08-19T20:27:53Z")

</div>

Ok, I manually updated the role mapping, then ran the module with state = “absent” and got a 403 unauthorized message. So I added the manage-users realm-manamgent privilege to the account I was using and was able to make this module add and remove group mappings.