Role with sensitive associated role

[dasniko]

Hi,
monitoring a composite role for containing a certain/sensitive associated role is currently not possible, right!? There would have to be a new Monitor for this or is this already somehow possible and I oversee this?

[malexmave]

Hi,

no, that is currently not possible in the way you describe it. You can monitor if a specific client has access to a role using the ClientWithSensitiveRole monitor, which takes into account composite roles. But if you are primarily interested not in the end result, but in the way it got there (through a specific composite role), then this would have to be a new monitor, yes.

[dasniko]

Thanks for the fast anwser.
I'm more interested in the actual config, then the result.
Example: the default-roles-<realm> contains the offline_access role as a composite by default. IMHO this is at the same/similar bad as having all the clients with a default offline_access client scope and most of the time I don't want this to be configured, unless there is a certain reason.