In my Blazor Application, I'm using Keycloak to manage user authentication and authorization. One of the features in my application consists of allowing the users to see a list of all Users Registered in the application. To do that I need to access "realms/realm/users" Keycloak API, but in order to do that I need to get the access token, and to do that I need to pass a 'username' and 'password' to HTTP POST request. How I am supposed to send user's password in request since I don't have access to that? Any thoughts?
My idea was to create a 'bot' user that would have this permission only and get the token for that 'bot' user instead of the actually logged in user, but it doesn't seem right.