Assign default roles to users when they register instead of directly to tokens

services/src/main/java/org/keycloak/services/managers/TokenManager.java

@@ -52,7 +52,6 @@ public class TokenManager {
         List<RoleModel> realmRolesRequested = code.getRealmRolesRequested();
         MultivaluedMap<String, RoleModel> resourceRolesRequested = code.getResourceRolesRequested();
         Set<String> realmMapping = realm.getRoleMappingValues(user);
-        realmMapping.addAll(realm.getDefaultRoles());
 
         if (realmMapping != null && realmMapping.size() > 0 && (scopeMap == null || scopeMap.containsKey("realm"))) {
             Set<String> scope = realm.getScopeMappingValues(client);
@@ -76,7 +75,6 @@ public class TokenManager {
         }
         for (ApplicationModel resource : realm.getApplications()) {
             Set<String> mapping = resource.getRoleMappingValues(user);
-            mapping.addAll(resource.getDefaultRoles());
             if (mapping != null && mapping.size() > 0 && (scopeMap == null || scopeMap.containsKey(resource.getName()))) {
                 Set<String> scope = resource.getScopeMappingValues(client);
                 if (scope.size() > 0) {

services/src/main/java/org/keycloak/services/resources/AccountService.java

@@ -373,7 +373,8 @@ public class AccountService {
         UserModel client = auth.getClient();
         if (realm.hasRole(client, Constants.APPLICATION_ROLE)) {
             // Tokens from cookies don't have roles
-            if (hasRole(client, Constants.ACCOUNT_MANAGE_ROLE) || (role != null && hasRole(client, role))) {
+            UserModel user = auth.getUser();
+            if (hasRole(user, Constants.ACCOUNT_MANAGE_ROLE) || (role != null && hasRole(user, role))) {
                 return true;
             }
         }
@@ -389,9 +390,6 @@ public class AccountService {
     }
 
     private boolean hasRole(UserModel user, String role) {
-        if (application.getDefaultRoles().contains(role)) {
-            return true;
-        }
         return application.hasRole(user, role);
     }
 

services/src/main/java/org/keycloak/services/resources/TokenService.java

@@ -8,6 +8,7 @@ import org.jboss.resteasy.jwt.JsonSerialization;
 import org.jboss.resteasy.logging.Logger;
 import org.jboss.resteasy.spi.HttpRequest;
 import org.jboss.resteasy.spi.HttpResponse;
+import org.keycloak.models.ApplicationModel;
 import org.keycloak.models.Constants;
 import org.keycloak.models.KeycloakSession;
 import org.keycloak.models.KeycloakTransaction;
@@ -323,6 +324,17 @@ public class TokenService {
             realm.updateCredential(user, credentials);
         }
 
+        for (String r : realm.getDefaultRoles()) {
+            realm.grantRole(user, realm.getRole(r));
+        }
+
+        for (ApplicationModel application : realm.getApplications()) {
+            for (String r : application.getDefaultRoles()) {
+                application.grantRole(user, application.getRole(r));
+            }
+        }
+
+
         return null;
     }