Keycloak return service in user api

user_7590475 0
Viewed 301

Hi I use Keycloak API to get users with status enabled GET /auth/admin/realms/Test/users?enabled=true

Receives users that are not on the user card in Keycloak

for example: [ {"username": "service-account-test" ...}, {"username": "service-account-test2" ...} ]

How to get rid of it?

keycloak-rest-api keycloak-services keycloak
2 Answers

The users with the prefix service-account- are automatically created by Keycloak for each client that has the OAuth2 flow client credentials enabled, which is represented in Keycloak with the option Service Accounts Enabled.

Therefore, you can query for the list of clients using the endpoint:

GET /{realm}/clients

filter to only get the clients with the field "serviceAccountsEnabled" set to true.

Then you can use that list to filter the users that you do not want, knowing that those users will have the name service-account-clientID where clientID is the clientID of the clients with the service account enabled.

user_13668710

Just use a blacklist to reduce the returned userlist. The endpoint doesn't support any negated lookup logic (see the endpoint specification).

Example:

Map<String,String> users = /* from rest API - map only as example /*
String[] blacklist = {"service-account-test", "service-account-test2"};
for(String blacklistEntry : blacklist) users.remove(blacklistEntry);

The runtime effect on this should be negligible at best.

user_49349370
Related