private void forwardAuthRoles(IPolicyContext context, KeycloakOauthConfigBean config,
            AccessToken parsedToken) {

        if (config.getForwardRoles().getActive()) {
            Access access = null;

            if (config.getForwardRoles().getApplicationName() != null) {
                access = parsedToken.getResourceAccess(config.getForwardRoles().getApplicationName());
            } else {
                access = parsedToken.getRealmAccess();
            }

            if (access == null || access.getRoles() == null) {
                context.setAttribute(AuthorizationPolicy.AUTHENTICATED_USER_ROLES, Collections.<String>emptySet());
            } else {
                context.setAttribute(AuthorizationPolicy.AUTHENTICATED_USER_ROLES, access.getRoles());
            }
        }
    }
@see io.apiman.gateway.engine.policies.AbstractMappedPolicy#doApply(io.apiman.gateway.engine.beans.ApiRequest,
     io.apiman.gateway.engine.policy.IPolicyContext, java.lang.Object,
     io.apiman.gateway.engine.policy.IPolicyChain)
plugins/keycloak-oauth-policy/src/main/java/io/apiman/plugins/keycloak_oauth_policy/KeycloakOauthPolicy.java