Access to users roles from a service account

user_2381099 0
Viewed 219

I tryied without success to fetch users roles from a service account. This is my configuration:

realm: realmA
  client: app-a
    roles: ['operator', 'manager']
  user: user-a
    roles on app-a: 'operator'

From other stack questions I know that I need to:

  • Make the client 'confidential'
  • Activate the service account for the client
  • give to the service account the roles realm-management -> query-users and realm-management -> view-users

Now I can ask KC an access token for my app-a service account to the end-point <KC URL>/realms/realmA/protocol/openid-connect/token and with this access token ask users data to this end-point <KC URL>/admin/realms/realmA/users after that I can retrieve my users list that has this shape:

[
{
  id: '10f5c814-1474-4ed0-9985-99b928cead3b',
  createdTimestamp: 1646751082376,
  username: 'username',
  enabled: true,
  totp: false,
  emailVerified: true,
  firstName: 'TheName',
  lastName: 'LastName',
  email: 'my@company',
  attributes: { time_intervals: [ '8-13' ] },
  disableableCredentialTypes: [],
  requiredActions: [],
  notBefore: 0,
  access: {
    manageGroupMembership: false,
    view: true,
    mapRoles: false,
    impersonate: false,
    manage: false
  }
}
]

Now I want to inspect the users roles at least the roles that the user has inside the client app-a but after hours and hours I can't figure out a way to do that. What is the correct way to do that?

keycloak
1 Answers

Now I want to inspect the users roles at least the roles that the user has inside the client app-a

For that try the endpoint:

<KC URL>/realms/realmA/users/<USER ID>/role-mappings/clients/<ID OF THE CLIENT>

In your case the <ID OF THE CLIENT> will be the id of the app-a.

user_13668710
Related