title: Why do we need Keycloak permissions/policies/scopes if we want to control access on the backend?
body: <p>I'm still not able to understand the purpose of keycloak permissions/scopes/policies if we still validate user per resource based on the role of the user.
  I use Spring Boot and all the documentations shows that role must be included in the configuration:</p>
  <pre><code>...
  .antMatchers(&quot;/api/account&quot;).hasRole(&quot;account&quot;)
  .anyRequest() 
  .authenticated(); 
  </code></pre>
  <p>We have configured the above policy in the keycloak but on the backend we again check the user role. Why do we need keycloak policy configuration?</p>
  <p>In keycloak, we can create authorization scopes. How can I use that scope to protect my api based on this scopes?</p>
  <p>I couldn't find a way to add authorization scopes into JWT token but keycloak provides UMA endpoints to fetch scopes, but would it be correct way to implement?</p>