keycloak-api-manager 2.0.0 → 2.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.idea/workspace.xml +1 -1
- package/README.md +611 -1062
- package/index.js +4 -35
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -87,29 +87,24 @@ the Keycloak Admin Console → clients (left sidebar) → choose your client →
|
|
|
87
87
|
## 📄 Usage Example
|
|
88
88
|
|
|
89
89
|
```js
|
|
90
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
90
91
|
const express = require('express');
|
|
91
92
|
// Import the Keycloak API Manager
|
|
92
|
-
const KeycloakManager = require('keycloak-api-manager');
|
|
93
|
-
|
|
94
|
-
const app = express();
|
|
95
|
-
|
|
96
93
|
|
|
97
94
|
// Configure and Initialize Keycloak manager api
|
|
98
95
|
// Initialize the manager with Keycloak credentials
|
|
99
|
-
|
|
96
|
+
await KeycloakManager.configure({
|
|
100
97
|
baseUrl: 'http://localhost:8080', // Keycloak base URL
|
|
101
98
|
realm: 'master', // Realm where the admin user belongs
|
|
102
99
|
clientId: 'admin-cli', // Keycloak admin client
|
|
103
100
|
username: 'admin', // Admin username
|
|
104
101
|
password: 'admin', // Admin password
|
|
102
|
+
grantType: 'password', // Type of authentication
|
|
105
103
|
});
|
|
106
104
|
|
|
107
|
-
// Authenticate and obtain access token
|
|
108
|
-
await keycloak.authenticate();
|
|
109
105
|
|
|
110
106
|
// Create a new user in the target realm
|
|
111
|
-
const newUser = await
|
|
112
|
-
realm: 'myrealm',
|
|
107
|
+
const newUser = await KeycloakManager.users.create({
|
|
113
108
|
username: 'john.doe',
|
|
114
109
|
email: 'john.doe@example.com',
|
|
115
110
|
firstName: 'John',
|
|
@@ -117,214 +112,43 @@ const newUser = await keycloak.createUser({
|
|
|
117
112
|
enabled: true,
|
|
118
113
|
});
|
|
119
114
|
|
|
120
|
-
//
|
|
121
|
-
await
|
|
122
|
-
realm: 'myrealm',
|
|
123
|
-
userId: newUser.id,
|
|
124
|
-
roleName: 'user',
|
|
125
|
-
});
|
|
126
|
-
|
|
127
|
-
console.log(`✅ User ${newUser.username} created and assigned to role 'user'`);
|
|
128
|
-
|
|
129
|
-
|
|
130
|
-
|
|
115
|
+
// List first page of users
|
|
116
|
+
const users = await KeycloakManager.users.find({ first: 0, max: 10 });
|
|
131
117
|
|
|
118
|
+
// find users by attributes
|
|
119
|
+
users = await KeycloakManager.users.find({ q: "phone:123" });
|
|
132
120
|
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
await keycloackAdapter.configure(app,{
|
|
137
|
-
"realm": "Realm-Project",
|
|
138
|
-
"auth-server-url": "https://YourKeycloakUrl:30040/",
|
|
139
|
-
"ssl-required": "external",
|
|
140
|
-
"resource": "keycloackclientName",
|
|
141
|
-
"credentials": {
|
|
142
|
-
"secret": "aaaaaaaaaa"
|
|
143
|
-
},
|
|
144
|
-
"confidential-port": 0
|
|
145
|
-
},
|
|
146
|
-
{
|
|
147
|
-
session:{
|
|
148
|
-
secret: 'mySecretForSession',
|
|
149
|
-
}
|
|
150
|
-
});
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
// Public route
|
|
154
|
-
app.get('/', (req, res) => {
|
|
155
|
-
res.send('Public route: no authentication required');
|
|
156
|
-
});
|
|
157
|
-
|
|
158
|
-
/* Protected routes (any authenticated user) */
|
|
159
|
-
|
|
160
|
-
// Example of login with keycloackAdapter.login function
|
|
161
|
-
// After login redirect to "/home"
|
|
162
|
-
app.get('/signIn', (req, res) => {
|
|
163
|
-
console.log("Your Custom Code");
|
|
164
|
-
keycloackAdapter.login(req,res,"/home")
|
|
165
|
-
|
|
166
|
-
});
|
|
167
|
-
|
|
168
|
-
// Example of login with keycloackAdapter.loginMiddleware middleware
|
|
169
|
-
// After login redirect to "/home"
|
|
170
|
-
app.get('/loginMiddleware', keycloackAdapter.loginMiddleware("/home") ,(req, res) => {
|
|
171
|
-
// Response handled by middleware, this section will never be reached.
|
|
172
|
-
});
|
|
173
|
-
|
|
174
|
-
// Example of logout with keycloackAdapter.logout function
|
|
175
|
-
// After login redirect to "http://localhost:3001/home"
|
|
176
|
-
app.get('/logout', (req, res) => {
|
|
177
|
-
console.log("Your Custom Code");
|
|
178
|
-
keycloackAdapter.logout(req,res,"http://localhost:3001/home");
|
|
179
|
-
});
|
|
180
|
-
|
|
181
|
-
// Example of logout with keycloackAdapter.logoutMiddleware middleware
|
|
182
|
-
// After login redirect to "http://localhost:3001/home"
|
|
183
|
-
app.get('/logoutMiddle', keycloackAdapter.logoutMiddleware("http://redirctUrl"), (req, res) => {
|
|
184
|
-
// Response handled by middleware, this section will never be reached.
|
|
121
|
+
// Override client configuration for all further requests:
|
|
122
|
+
setConfig({
|
|
123
|
+
realmName: 'another-realm',
|
|
185
124
|
});
|
|
186
125
|
|
|
126
|
+
// This operation will now be performed in 'another-realm' if the user has access.
|
|
127
|
+
const groups = await KeycloakManager.groups.find();
|
|
187
128
|
|
|
188
|
-
//
|
|
189
|
-
//
|
|
190
|
-
|
|
191
|
-
|
|
192
|
-
|
|
193
|
-
|
|
129
|
+
// Set a `realm` property to override the realm for only a single operation.
|
|
130
|
+
// For example, creating a user in another realm:
|
|
131
|
+
await KeycloakManager.users.create({
|
|
132
|
+
realm: 'a-third-realm',
|
|
133
|
+
username: 'username',
|
|
134
|
+
email: 'user@third-realm.com',
|
|
194
135
|
});
|
|
195
136
|
|
|
196
|
-
// Example of protection with keycloackAdapter.protectMiddleware middleware
|
|
197
|
-
// whith a static client role validation string
|
|
198
|
-
// Access is allowed only for authenticated admin users
|
|
199
|
-
app.get('/privateStaticClientRole', keycloackAdapter.protectMiddleware("admin"), (req, res) => {
|
|
200
|
-
// "Your Custom Code"
|
|
201
|
-
res.send("Is its admin.");
|
|
202
|
-
});
|
|
203
137
|
|
|
204
|
-
//
|
|
205
|
-
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
// "Your Custom Code"
|
|
209
|
-
res.send("Is its admin realm:admin.");
|
|
138
|
+
// create a new realm, If id omitted, Keycloak uses the realm name as the ID.
|
|
139
|
+
const realm = await KeycloakManager.realms.create({
|
|
140
|
+
id: "123456",
|
|
141
|
+
realm: "new-realm",
|
|
210
142
|
});
|
|
211
143
|
|
|
212
|
-
// Example of protection with keycloackAdapter.protectMiddleware middleware
|
|
213
|
-
// whith a static other client role validation string
|
|
214
|
-
// Access is allowed only for authenticated otherClient admin users
|
|
215
|
-
app.get('/privateStaticRealmRole', keycloackAdapter.protectMiddleware("otherClient:admin"), (req, res) => {
|
|
216
|
-
// "Your Custom Code"
|
|
217
|
-
res.send("Is its admin otherClient:admin.");
|
|
218
|
-
});
|
|
219
144
|
|
|
220
|
-
//
|
|
221
|
-
|
|
222
|
-
|
|
223
|
-
let tmpFunction=function (token, req) {
|
|
224
|
-
return token.hasRole('admin');
|
|
225
|
-
}
|
|
226
|
-
app.get('/isAdmin', keycloackAdapter.protectMiddleware(tmpFunction), (req, res) => {
|
|
227
|
-
// "Your Custom Code"
|
|
228
|
-
res.send("Is its admin tmpFunction.");
|
|
145
|
+
// Get realm Info
|
|
146
|
+
realm = await KeycloakManager.realms.findOne({
|
|
147
|
+
realm: "new-realm"
|
|
229
148
|
});
|
|
230
149
|
|
|
150
|
+
console.log("realm info:", realm);
|
|
231
151
|
|
|
232
|
-
// Example of protection with keycloackAdapter.customProtectMiddleware middleware
|
|
233
|
-
// whith a control function tmpFunctionString
|
|
234
|
-
// Access is allowed only for authenticated users with role defined by tmpFunctionString
|
|
235
|
-
let tmpFunctionString=function (req,res) {
|
|
236
|
-
let id=req.params.id
|
|
237
|
-
// Control String by url param Id
|
|
238
|
-
return (`${id}`);
|
|
239
|
-
}
|
|
240
|
-
app.get('/:id/isAdmin', keycloackAdapter.customProtectMiddleware(tmpFunctionString), (req, res) => {
|
|
241
|
-
// "Your Custom Code"
|
|
242
|
-
res.send("Is its admin tmpFunctionString.");
|
|
243
|
-
});
|
|
244
|
-
|
|
245
|
-
|
|
246
|
-
// Example of protection with keycloackAdapter.encodeTokenRole middleware
|
|
247
|
-
// Encode the token and add it to req.encodedTokenRole
|
|
248
|
-
// Use req.encodedTokenRole.hasRole("role") to check whether the token has that role or not
|
|
249
|
-
app.get('/encodeToken', keycloackAdapter.encodeTokenRole(), (req, res) => {
|
|
250
|
-
if(req.encodedTokenRole.hasRole('realm:admin'))
|
|
251
|
-
res.send("Is its a realm admin");
|
|
252
|
-
else
|
|
253
|
-
res.send("Is its'n a realm admin");
|
|
254
|
-
|
|
255
|
-
});
|
|
256
|
-
|
|
257
|
-
// This section provides examples of how to protect resources based on permissions
|
|
258
|
-
// rather than roles.
|
|
259
|
-
|
|
260
|
-
// Example of protection with keycloackAdapter.enforcerMiddleware middleware
|
|
261
|
-
// whith a static control string
|
|
262
|
-
// Access is allowed only for users with 'ui-admin-resource' permission defined
|
|
263
|
-
// in keycloak
|
|
264
|
-
app.get('/adminResource', keycloackAdapter.enforcerMiddleware('ui-admin-resource'), (req, res) => {
|
|
265
|
-
// If this section is reached, the user has the required privileges;
|
|
266
|
-
// otherwise, the middleware responds with a 403 Access Denied.
|
|
267
|
-
res.send('You are an authorized ui-admin-resource User');
|
|
268
|
-
});
|
|
269
|
-
|
|
270
|
-
// Example of protection with keycloackAdapter.enforcerMiddleware middleware
|
|
271
|
-
// whith a control function tmpFunctionEnforceValidation
|
|
272
|
-
// Access is allowed only for users with 'ui-admin-resource' or
|
|
273
|
-
// ui-viewer-resource permission defined in keycloak
|
|
274
|
-
let tmpFunctionEnforceValidation=function (token,req,callback) {
|
|
275
|
-
// Check permission using token.hasPermission, which performs the verification
|
|
276
|
-
// and responds with a callback that returns true if the permission is valid,
|
|
277
|
-
// and false otherwise.
|
|
278
|
-
if(token.hasPermission('ui-admin-resource',function(permission){
|
|
279
|
-
if(permission) callback(true);
|
|
280
|
-
else if(token.hasPermission('ui-viewer-resource',function(permission){
|
|
281
|
-
if(permission) callback(true);
|
|
282
|
-
else callback(false);
|
|
283
|
-
}));
|
|
284
|
-
}));
|
|
285
|
-
}
|
|
286
|
-
app.get('/adminOrViewerResorce', keycloackAdapter.enforcerMiddleware(tmpFunctionEnforceValidation), (req, res) => {
|
|
287
|
-
// If this section is reached, the user has the required privileges
|
|
288
|
-
// driven by tmpFunctionEnforceValidation; otherwise, the middleware responds
|
|
289
|
-
// with a 403 Access Denied.
|
|
290
|
-
res.send('You are an authorized User');
|
|
291
|
-
});
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
// Example of protection with keycloackAdapter.customEnforcerMiddleware middleware
|
|
295
|
-
// whith a control function tmpFunctionEnforce that define the control string
|
|
296
|
-
// Access is allowed only for users with a url params ':permission' permission defined
|
|
297
|
-
// in keycloak
|
|
298
|
-
let tmpFunctionEnforce=function (req,res) {
|
|
299
|
-
// Permission that depends on a URL parameter.
|
|
300
|
-
return(req.params.permission);
|
|
301
|
-
}
|
|
302
|
-
app.get('/urlParameterPermission/:permission', keycloackAdapter.customEnforcerMiddleware(tmpFunctionEnforce), (req, res) => {
|
|
303
|
-
res.send(`You are an authorized User with ${req.params.permission} permission`);
|
|
304
|
-
});
|
|
305
|
-
|
|
306
|
-
// Example of protection with keycloackAdapter.encodeTokenPermission middleware
|
|
307
|
-
// Encode the token permission and add it to req.encodedTokenPremission
|
|
308
|
-
// Use req.encodedTokenPremission.hasPermission("permission") to check whether
|
|
309
|
-
// the token has that permission or not
|
|
310
|
-
app.get('/encodeTokenPermission', keycloackAdapter.encodeTokenPermission(), (req, res) => {
|
|
311
|
-
// Check permission using token.hasPermission, which performs the verification
|
|
312
|
-
// and responds with a callback that returns true if the permission is valid,
|
|
313
|
-
// and false otherwise.
|
|
314
|
-
req.encodedTokenPremission.hasPermission('ui-admin-resource', function(permission){
|
|
315
|
-
if(permission)
|
|
316
|
-
res.send('You are an authorized User by ui-admin-resource permission');
|
|
317
|
-
else res.status(403).send("access Denied");
|
|
318
|
-
});
|
|
319
|
-
});
|
|
320
|
-
|
|
321
|
-
|
|
322
|
-
|
|
323
|
-
// Start the server
|
|
324
|
-
const PORT = process.env.PORT || 3000;
|
|
325
|
-
app.listen(PORT, () => {
|
|
326
|
-
console.log(`Server running at http://localhost:${PORT}`);
|
|
327
|
-
});
|
|
328
152
|
```
|
|
329
153
|
|
|
330
154
|
---
|
|
@@ -334,602 +158,58 @@ app.listen(PORT, () => {
|
|
|
334
158
|
In your Express application:
|
|
335
159
|
|
|
336
160
|
```js
|
|
337
|
-
|
|
161
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
338
162
|
|
|
339
|
-
// Configure and Initialize Keycloak
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
|
|
343
|
-
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
},
|
|
350
|
-
{
|
|
351
|
-
session:{
|
|
352
|
-
secret: 'mySecretForSession',
|
|
353
|
-
}
|
|
354
|
-
})
|
|
163
|
+
// Configure and Initialize Keycloak manager api
|
|
164
|
+
// Initialize the manager with Keycloak credentials
|
|
165
|
+
await KeycloakManager.configure({
|
|
166
|
+
baseUrl: 'http://localhost:8080', // Keycloak base URL
|
|
167
|
+
realm: 'master', // Realm where the admin user belongs
|
|
168
|
+
clientId: 'admin-cli', // Keycloak admin client
|
|
169
|
+
username: 'admin', // Admin username
|
|
170
|
+
password: 'admin', // Admin password
|
|
171
|
+
grantType: 'password', // Type of authentication
|
|
172
|
+
});
|
|
355
173
|
```
|
|
356
174
|
|
|
357
|
-
|
|
358
|
-
|
|
359
|
-
|
|
360
|
-
It is an async function and returns a promise
|
|
175
|
+
Configure is a configuration function for the Keycloak-api-manager.
|
|
176
|
+
It must be called at app startup, before to use the administrative
|
|
177
|
+
functions exposed by this library
|
|
361
178
|
|
|
362
179
|
Parameters:
|
|
363
|
-
-
|
|
364
|
-
- keyCloakConfig: JSON object containing the Keycloak client configuration.
|
|
365
|
-
This can be obtained from the Keycloak admin console:
|
|
366
|
-
Clients → [client name] → Installation → "Keycloak OIDC JSON" → Download
|
|
367
|
-
Example:
|
|
368
|
-
{
|
|
369
|
-
"realm": "realm-name",
|
|
370
|
-
"auth-server-url": "https://keycloak.example.com/",
|
|
371
|
-
"ssl-required": "external",
|
|
372
|
-
"resource": "client-name",
|
|
373
|
-
"credentials": { "secret": "secret-code" },
|
|
374
|
-
"confidential-port": 0
|
|
375
|
-
}
|
|
376
|
-
- keyCloakOptions: advanced configuration options for the adapter.
|
|
377
|
-
Main supported options:
|
|
378
|
-
- session: Express session configuration (as in express-session)
|
|
379
|
-
- scope: authentication scopes (e.g., 'openid profile email offline_access')
|
|
380
|
-
Note: to use offline_access, the client must have the option enabled and
|
|
381
|
-
the user must have the offline_access role.
|
|
382
|
-
- idpHint: to suggest an identity provider to Keycloak during login
|
|
383
|
-
- cookies: to enable cookie handling
|
|
384
|
-
- realmUrl: to override the realm URL
|
|
385
|
-
- adminClientCredentials: [Optional] Advanced configuration for setting up the realm-admin user or client,
|
|
180
|
+
- adminClientCredentials: [required] Advanced configuration for setting up the realm-admin user or client,
|
|
386
181
|
which will be used as the administrator to manage Keycloak via API.
|
|
387
182
|
This is required in order to use the administrative functions exposed by this library.
|
|
388
183
|
If this parameter is not provided, it will not be possible to use the administrative functions of Keycloak
|
|
389
|
-
exposed by this adapter
|
|
390
|
-
keycloakAdapter.kcAdminClient will result in a runtime error due to access on an undefined object
|
|
184
|
+
exposed by this adapter, so any attempt to call KeycloakManager.{function} will result in a runtime error due to access on an undefined object
|
|
391
185
|
Main supported options:
|
|
392
|
-
|
|
393
|
-
|
|
394
|
-
|
|
395
|
-
|
|
396
|
-
|
|
397
|
-
|
|
398
|
-
|
|
399
|
-
|
|
400
|
-
|
|
401
|
-
|
|
402
|
-
|
|
403
|
-
|
|
404
|
-
- clientSecret: [Optional] string containing the client secret of the client. Required for client_credentials or confidential clients.
|
|
405
|
-
- totp: string for Time-based One-Time Password (TOTP) for multifactor authentication (MFA), if enabled for the user.
|
|
406
|
-
- offlineToken: [Optional] boolean value. If true, requests an offline token (used for long-lived refresh tokens). Default is false.
|
|
407
|
-
- refreshToken: [Optional] string containing a valid refresh token to request a new access token when using the refresh_token grant type.
|
|
186
|
+
- grantType: [required] The OAuth2 grant type used for authentication. example "password". Possible values: 'password', 'client_credentials', 'refresh_token', etc.
|
|
187
|
+
- clientId: [required] string containing the client ID configured in Keycloak. Required for all grant types.
|
|
188
|
+
- username: [optional] string username. Required when using the password grant type.
|
|
189
|
+
- password: [optional] string password. Required when using the password grant type.
|
|
190
|
+
- baseUrl: [Optional] Keycloak base Url
|
|
191
|
+
- realmName: [Optional] A String that specifies the realm to authenticate against, if different from the "keyCloakConfig.realm" parameter. If you intend to use Keycloak administrator credentials, this should be set to 'master'.
|
|
192
|
+
- scope: [Optional] A string that specifies The OAuth2 scope requested during authentication (optional). Typically, not required for administrative clients. example:openid profile
|
|
193
|
+
- requestOptions: [Optional] JSON parameters to configure HTTP requests (such as custom headers, timeouts, etc.). It is compatible with the Fetch API standard. Fetch request options https://developer.mozilla.org/en-US/docs/Web/API/fetch#options
|
|
194
|
+
- clientSecret: [Optional] string containing the client secret of the client. Required for client_credentials or confidential clients.
|
|
195
|
+
- totp: string for Time-based One-Time Password (TOTP) for multifactor authentication (MFA), if enabled for the user.
|
|
196
|
+
- offlineToken: [Optional] boolean value. If true, requests an offline token (used for long-lived refresh tokens). Default is false.
|
|
197
|
+
- refreshToken: [Optional] string containing a valid refresh token to request a new access token when using the refresh_token grant type.
|
|
408
198
|
---
|
|
409
199
|
|
|
410
|
-
## 🔧 Available Middlewares
|
|
411
|
-
|
|
412
|
-
### `underKeycloakProtection(callback) - deprecated - `
|
|
413
|
-
@deprecated. Use the `configure` Method with `await keycloakAdapter.configure(...)`,
|
|
414
|
-
then define your resources as you normally would in Express:
|
|
415
|
-
```js
|
|
416
|
-
await keycloakAdapter.configure(config_Parameters);
|
|
417
|
-
|
|
418
|
-
// all your routes
|
|
419
|
-
|
|
420
|
-
app.get('/my-route', handler);
|
|
421
|
-
```
|
|
422
|
-
|
|
423
|
-
Alternatively, if you prefer to define your resources inside a container after configuration,
|
|
424
|
-
you can use the `then` syntax:
|
|
425
|
-
```js
|
|
426
|
-
keycloakAdapter.configure(configParameters).then(() => {
|
|
427
|
-
// Define all your routes here
|
|
428
|
-
app.get('/my-route', handler);
|
|
429
|
-
});
|
|
430
|
-
```
|
|
431
|
-
|
|
432
|
-
This Method is deprecated and will be removed in future versions.
|
|
433
|
-
|
|
434
|
-
Method to define Express routes that must be protected by Keycloak.
|
|
435
|
-
|
|
436
|
-
This method must be called **after** Keycloak has been configured with `configure()`.
|
|
437
|
-
The routes declared inside the provided callback will be protected and will have access
|
|
438
|
-
to authentication/authorization features managed by Keycloak.
|
|
439
|
-
|
|
440
|
-
📌 Public (unprotected) routes should be declared **before** calling this method.
|
|
441
|
-
|
|
442
|
-
@param {Function} callback - A function that defines all routes to be protected.
|
|
443
|
-
It must contain exclusively routes requiring authentication.
|
|
444
|
-
|
|
445
|
-
✅ Usage example:
|
|
446
|
-
```js
|
|
447
|
-
// Public route not protected by Keycloak
|
|
448
|
-
app.get('/public', (req, res) => {
|
|
449
|
-
res.send('Public content');
|
|
450
|
-
});
|
|
451
|
-
|
|
452
|
-
// Section of routes protected by Keycloak
|
|
453
|
-
keycloakAdapter.underKeycloakProtection(() => {
|
|
454
|
-
|
|
455
|
-
// This function is deprecated and will be removed in future versions.
|
|
456
|
-
// It is retained only for backward compatibility with older versions
|
|
457
|
-
|
|
458
|
-
// Route protected by authentication
|
|
459
|
-
app.get('/confidential', keycloakAdapter.protectMiddleware(), (req, res) => {
|
|
460
|
-
res.send('Confidential content visible only to authenticated users');
|
|
461
|
-
});
|
|
462
|
-
|
|
463
|
-
// Route with forced login: handled directly by middleware
|
|
464
|
-
app.get('/loginMiddleware', keycloakAdapter.loginMiddleware("/home"), (req, res) => {
|
|
465
|
-
// This response will never be sent because the middleware handles the
|
|
466
|
-
// request directly
|
|
467
|
-
});
|
|
468
|
-
});
|
|
469
|
-
```
|
|
470
|
-
|
|
471
|
-
### `protectMiddleware([conditions])`
|
|
472
|
-
Middleware to protect Express routes based on authentication and, optionally,
|
|
473
|
-
authorization via Keycloak roles.
|
|
474
|
-
|
|
475
|
-
Allows restricting access to a resource only to authenticated users or
|
|
476
|
-
to those possessing specific roles in the realm or in a Keycloak client.
|
|
477
|
-
|
|
478
|
-
@param {string|function} [conditions]
|
|
479
|
-
- If a string, specifies one or more required roles, using the syntax:
|
|
480
|
-
- 'role' → client role in the configured client (e.g., 'admin')
|
|
481
|
-
- 'clientid:role' → client role of a specific client (e.g., 'myclient:editor')
|
|
482
|
-
- 'realm:role' → realm role (e.g., 'realm:superuser')
|
|
483
|
-
- If a function, receives (token, req) and must return true or false synchronously.
|
|
484
|
-
This function enables custom authorization logic.
|
|
485
|
-
- The `token` object passed to the authorization function exposes methods such as:
|
|
486
|
-
- token.hasRole('admin') // client role in configured client
|
|
487
|
-
- token.hasRole('realm:superuser') // realm role
|
|
488
|
-
- token.hasRole('my-client:editor') // client role of a specific client
|
|
489
|
-
- token.hasResourceRole('editor', 'my-client-id') // equivalent to hasRole('my-client:editor')
|
|
490
|
-
|
|
491
|
-
The authorization function must be synchronous and return true (allow access) or false (deny access).
|
|
492
|
-
|
|
493
|
-
@returns {Function} Express middleware to protect the route.
|
|
494
|
-
|
|
495
|
-
✅ Usage example:
|
|
496
|
-
```js
|
|
497
|
-
|
|
498
|
-
// Authentication only, no role check
|
|
499
|
-
app.get('/admin', keycloakAdapter.protectMiddleware(), (req, res) => {
|
|
500
|
-
res.send('Only authenticated users can see this resource.');
|
|
501
|
-
});
|
|
502
|
-
|
|
503
|
-
// Check on client role of configured client (e.g., 'admin')
|
|
504
|
-
app.get('/admin', keycloakAdapter.protectMiddleware('admin'), (req, res) => {
|
|
505
|
-
res.send('Only users with the admin client role can access.');
|
|
506
|
-
});
|
|
507
|
-
|
|
508
|
-
// Check on role of a specific client (e.g., client 'clientid', role 'admin')
|
|
509
|
-
app.get('/admin', keycloakAdapter.protectMiddleware('clientid:admin'), (req, res) => {
|
|
510
|
-
res.send('Only users with admin role in client "clientid" can access.');
|
|
511
|
-
});
|
|
512
|
-
|
|
513
|
-
// Check on realm role (e.g., 'superuser' role at realm level)
|
|
514
|
-
app.get('/admin', keycloakAdapter.protectMiddleware('realm:superuser'), (req, res) => {
|
|
515
|
-
res.send('Only users with realm superuser role can access.');
|
|
516
|
-
});
|
|
517
|
-
|
|
518
|
-
// Custom synchronous authorization function
|
|
519
|
-
app.get('/custom', keycloakAdapter.protectMiddleware((token, req) => {
|
|
520
|
-
// Allow only if user has realm role 'editor'
|
|
521
|
-
// and the request has a specific custom header
|
|
522
|
-
return token.hasRealmRole('editor') && req.headers['x-custom-header'] === 'OK';
|
|
523
|
-
}), (req, res) => {
|
|
524
|
-
res.send('Access granted by custom authorization function.');
|
|
525
|
-
});
|
|
526
|
-
|
|
527
|
-
```
|
|
528
|
-
|
|
529
|
-
|
|
530
|
-
### `customProtectMiddleware(fn)`
|
|
531
|
-
Middleware similar to `protectMiddleware` but with dynamic role checking via a function.
|
|
532
|
-
|
|
533
|
-
Unlike `protectMiddleware`, which accepts a string expressing the role or a control function
|
|
534
|
-
that works on the token, this middleware accepts a function that receives the Express
|
|
535
|
-
request and response objects `req` and `res` and must return a string representing the role control string.
|
|
536
|
-
|
|
537
|
-
This is useful for parametric resources where the role control string must be dynamically generated based on the request,
|
|
538
|
-
for example, based on URL parameters or query strings.
|
|
539
|
-
|
|
540
|
-
Note: this function **does not** access or parse the token, nor performs any checks other than the role,
|
|
541
|
-
so it cannot be used for complex logic depending on request properties other than the role
|
|
542
|
-
(e.g., client IP, custom headers, etc.).
|
|
543
|
-
The function's sole task is to generate the role control string.
|
|
544
|
-
|
|
545
|
-
--- Parameters ---
|
|
546
|
-
|
|
547
|
-
@param {function} customFunction - function that receives (req, res) and returns a string
|
|
548
|
-
with the role control string to pass to Keycloak.
|
|
549
|
-
|
|
550
|
-
✅ Usage example:
|
|
551
|
-
```js
|
|
552
|
-
|
|
553
|
-
app.get('/custom/:id', keycloakAdapter.customProtectMiddleware((req) => {
|
|
554
|
-
// Dynamically builds the client role based on URL parameter 'id'
|
|
555
|
-
return `clientRole${req.params.id}`;
|
|
556
|
-
}), (req, res) => {
|
|
557
|
-
res.send(`Access granted to users with role 'clientRole${req.params.id}'`);
|
|
558
|
-
});
|
|
559
|
-
```
|
|
560
|
-
|
|
561
|
-
|
|
562
|
-
### `enforcerMiddleware(conditions, options)`
|
|
563
|
-
`enforcerMiddleware` is a middleware to enable permission checks
|
|
564
|
-
based on resources and policies defined in Keycloak Authorization Services (UMA 2.0-based).
|
|
565
|
-
|
|
566
|
-
Unlike `protectMiddleware` and similar, which only verify authentication or roles,
|
|
567
|
-
`enforcerMiddleware` allows checking if the user has permission to access
|
|
568
|
-
a specific protected resource through flexible and dynamic policies.
|
|
569
|
-
|
|
570
|
-
Useful in contexts where resources are registered in Keycloak (such as documents, instances, dynamic entities) and
|
|
571
|
-
protected by flexible policies.
|
|
572
|
-
|
|
573
|
-
--- Parameters ---
|
|
574
|
-
|
|
575
|
-
@param {string|function} conditions
|
|
576
|
-
- string containing the name of the resource or permission to check
|
|
577
|
-
- custom check function with signature:
|
|
578
|
-
function(token, req, callback)
|
|
579
|
-
- token: decoded Keycloak token
|
|
580
|
-
- req: Express request
|
|
581
|
-
- callback(boolean): invoke with true if authorized, false otherwise
|
|
582
|
-
|
|
583
|
-
@param {object} [options] (optional)
|
|
584
|
-
- response_mode: 'permissions' (default) or 'token'
|
|
585
|
-
- claims: object with claim info for dynamic policies (e.g. owner id matching)
|
|
586
|
-
- resource_server_id: resource client id (default: current client)
|
|
587
|
-
|
|
588
|
-
--- How it works ---
|
|
589
|
-
- If conditions is a function, it is used for custom checks with callback.
|
|
590
|
-
- If conditions is a string, `keycloak.enforcer(conditions, options)` is used for the check.
|
|
591
|
-
|
|
592
|
-
--- response_mode modes ---
|
|
593
|
-
1) 'permissions' (default)
|
|
594
|
-
- Keycloak returns the list of granted permissions (no new token)
|
|
595
|
-
- Permissions available in `req.permissions`
|
|
596
|
-
|
|
597
|
-
2) 'token'
|
|
598
|
-
- Keycloak issues a new access token containing the granted permissions
|
|
599
|
-
- Permissions available in `req.kauth.grant.access_token.content.authorization.permissions`
|
|
600
|
-
- Useful for apps with sessions and decision caching
|
|
601
|
-
|
|
602
|
-
--- Keycloak requirements ---
|
|
603
|
-
|
|
604
|
-
The client must have:
|
|
605
|
-
- Authorization Enabled = ON
|
|
606
|
-
- Policy Enforcement Mode = Enforcing
|
|
607
|
-
- Add permissions to access token = ON
|
|
608
|
-
|
|
609
|
-
You must also configure in Keycloak:
|
|
610
|
-
- Resources
|
|
611
|
-
- Policies (e.g., role, owner, JS script)
|
|
612
|
-
- Permissions (associate policies to resources)
|
|
613
200
|
|
|
614
|
-
|
|
615
|
-
|
|
616
|
-
|
|
617
|
-
// Check with static string
|
|
618
|
-
app.get('/onlyAdminroute', keycloakAdapter.enforcerMiddleware('ui-admin-resource'), (req, res) => {
|
|
619
|
-
res.send('You are an authorized admin for this resource');
|
|
620
|
-
});
|
|
621
|
-
|
|
622
|
-
// Check with custom function (async with callback)
|
|
623
|
-
app.get('/onlyAdminrouteByfunction', keycloakAdapter.enforcerMiddleware(function(token, req, callback) {
|
|
624
|
-
token.hasPermission('ui-admin-resource', function(permission) {
|
|
625
|
-
if (permission) callback(true);
|
|
626
|
-
else {
|
|
627
|
-
token.hasPermission('ui-viewer-resource', function(permission) {
|
|
628
|
-
callback(permission ? true : false);
|
|
629
|
-
});
|
|
630
|
-
}
|
|
631
|
-
});
|
|
632
|
-
}), (req, res) => {
|
|
633
|
-
res.send('You are an authorized admin or viewer (custom check)');
|
|
634
|
-
});
|
|
635
|
-
```
|
|
636
|
-
|
|
637
|
-
### `customEnforcerMiddleware(fn, options)`
|
|
638
|
-
`customEnforcerMiddleware` is a middleware for permission checks based on resources and policies
|
|
639
|
-
defined in Keycloak Authorization Services (UMA 2.0), using dynamic permission strings.
|
|
640
|
-
|
|
641
|
-
This middleware is similar to `enforcerMiddleware`, but takes a function
|
|
642
|
-
`customFunction(req, res)` as a parameter, which must dynamically return
|
|
643
|
-
the permission/resource string to be checked.
|
|
644
|
-
|
|
645
|
-
--- Parameters ---
|
|
646
|
-
|
|
647
|
-
@param {function} customFunction
|
|
648
|
-
Function that receives `req` and `res` and returns the control string for Keycloak.
|
|
649
|
-
Example:
|
|
650
|
-
```js
|
|
651
|
-
function customFunction(req, res) {
|
|
652
|
-
// Your function logic
|
|
653
|
-
return req.params.permission;
|
|
654
|
-
}
|
|
655
|
-
```
|
|
656
|
-
|
|
657
|
-
@param {object} [options] (optional)
|
|
658
|
-
Additional options passed to `keycloak.enforcer()`, including:
|
|
659
|
-
- response_mode: 'permissions' (default) or 'token'
|
|
660
|
-
- claims: object with claim info for dynamic policies (e.g., owner ID)
|
|
661
|
-
- resource_server_id: string representing the resource client ID (default: current client)
|
|
662
|
-
|
|
663
|
-
--- response_mode options ---
|
|
664
|
-
1) 'permissions' (default)
|
|
665
|
-
- The server returns only the list of granted permissions (no new token)
|
|
666
|
-
- Permissions available in `req.permissions`
|
|
667
|
-
|
|
668
|
-
2) 'token'
|
|
669
|
-
- The server issues a new access token with granted permissions
|
|
670
|
-
- Permissions available in `req.kauth.grant.access_token.content.authorization.permissions`
|
|
671
|
-
- Useful for decision caching, session handling, automatic token refresh
|
|
672
|
-
|
|
673
|
-
--- Keycloak Requirements ---
|
|
674
|
-
|
|
675
|
-
The client must be configured with:
|
|
676
|
-
- Authorization Enabled = ON
|
|
677
|
-
- Policy Enforcement Mode = Enforcing
|
|
678
|
-
- Add permissions to access token = ON
|
|
679
|
-
|
|
680
|
-
You must also have created:
|
|
681
|
-
- Resources
|
|
682
|
-
- Policies (e.g., role, owner, JS rules)
|
|
683
|
-
- Permissions (linking policies to resources)
|
|
684
|
-
|
|
685
|
-
✅ Usage example:
|
|
686
|
-
```js
|
|
687
|
-
|
|
688
|
-
const tmpFunctionEnforce = function(req, res) {
|
|
689
|
-
return req.params.permission; // dynamic permission from URL parameter
|
|
690
|
-
};
|
|
691
|
-
|
|
692
|
-
app.get('/onlyAdminrouteByfunction/:permission', keycloakAdapter.customEnforcerMiddleware(tmpFunctionEnforce), (req, res) => {
|
|
693
|
-
res.send('You are an authorized user with dynamic permission: ' + req.params.permission);
|
|
694
|
-
});
|
|
695
|
-
|
|
696
|
-
```
|
|
697
|
-
|
|
698
|
-
### `encodeTokenRole()`
|
|
699
|
-
`encodeTokenRole` is a middleware that decodes the Keycloak token and adds it
|
|
700
|
-
to the Express request as `req.encodedTokenRole`.
|
|
701
|
-
|
|
702
|
-
Unlike `protectMiddleware` or `customProtectMiddleware`, this middleware
|
|
703
|
-
does NOT perform any role or authentication checks, but simply extracts
|
|
704
|
-
and makes the decoded token available within the route handler function.
|
|
705
|
-
|
|
706
|
-
It is especially useful when you want to perform custom logic based on roles
|
|
707
|
-
or other information contained in the token directly in the route handler,
|
|
708
|
-
for example showing different content based on role.
|
|
709
|
-
|
|
710
|
-
--- Contents of `req.encodedTokenRole` ---
|
|
711
|
-
|
|
712
|
-
Represents the decoded Keycloak token and exposes several useful methods such as:
|
|
713
|
-
- token.hasRole('admin') // true/false if it has client role "admin"
|
|
714
|
-
- token.hasRole('realm:superuser') // true/false if it has realm role "superuser"
|
|
715
|
-
- token.hasRole('my-client:editor') // true/false if it has client role "editor" for client "my-client"
|
|
716
|
-
- token.hasResourceRole('editor', 'my-client-id') // identical to hasRole('my-client:editor')
|
|
717
|
-
|
|
718
|
-
✅ Usage example:
|
|
719
|
-
```js
|
|
720
|
-
|
|
721
|
-
app.get('/encodeToken', keycloakAdapter.encodeTokenRole(), (req, res) => {
|
|
722
|
-
if (req.encodedTokenRole.hasRole('realm:admin')) {
|
|
723
|
-
res.send("User with admin (realm) role in encodeToken");
|
|
724
|
-
} else {
|
|
725
|
-
res.send("Regular user in encodeToken");
|
|
726
|
-
}
|
|
727
|
-
});
|
|
728
|
-
|
|
729
|
-
```
|
|
730
|
-
|
|
731
|
-
### `encodeTokenPermission()`
|
|
732
|
-
`encodeTokenPermission` ia s Middleware whose sole purpose is to decode the access token present in the request
|
|
733
|
-
and add to the `req` object a property called `encodedTokenPermission` containing the token's permissions.
|
|
734
|
-
|
|
735
|
-
Unlike `enforcerMiddleware` and `customEnforcerMiddleware`, it **does not perform any access**
|
|
736
|
-
or authorization checks, but exposes a useful method (`hasPermission`) for checking permissions
|
|
737
|
-
within the route handler.
|
|
738
|
-
|
|
739
|
-
It is particularly useful when:
|
|
740
|
-
- you want to **customize the response** based on the user's permissions (e.g., show a different page),
|
|
741
|
-
- you want to **manually handle access** or perform custom checks on multiple permissions,
|
|
742
|
-
- you do not want to block access upfront but decide dynamically within the route handler.
|
|
743
|
-
|
|
744
|
-
--- Additions to `req` ---
|
|
745
|
-
|
|
746
|
-
After applying the middleware, `req` contains:
|
|
747
|
-
- @property {Object} req.encodedTokenPermission
|
|
748
|
-
An object exposing the method:
|
|
749
|
-
- hasPermission(permission: string, callback: function(boolean))
|
|
750
|
-
Checks whether the token contains the specified permission.
|
|
751
|
-
The callback receives `true` if the permission is present, `false` otherwise.
|
|
752
|
-
|
|
753
|
-
✅ Usage example:
|
|
754
|
-
```js
|
|
755
|
-
|
|
756
|
-
app.get('/encodeTokenPermission',
|
|
757
|
-
keycloakAdapter.encodeTokenPermission(),
|
|
758
|
-
(req, res) => {
|
|
759
|
-
req.encodedTokenPermission.hasPermission('ui-admin-resource', function(perm) {
|
|
760
|
-
if (perm)
|
|
761
|
-
res.send('You are an authorized admin user by function permission parameters');
|
|
762
|
-
else
|
|
763
|
-
res.status(403).send('Access Denied by encodeTokenPermission');
|
|
764
|
-
});
|
|
765
|
-
});
|
|
766
|
-
|
|
767
|
-
```
|
|
768
|
-
|
|
769
|
-
### `loginMiddleware(redirectTo)`
|
|
770
|
-
`loginMiddleware` is a Middleware used to **force user authentication** via Keycloak.
|
|
771
|
-
|
|
772
|
-
It is particularly useful when you want to:
|
|
773
|
-
- ensure the user is authenticated,
|
|
774
|
-
- redirect the user to a specific page after login or when access is denied,
|
|
775
|
-
- integrate automatic login flows on routes that don’t require direct authorization,
|
|
776
|
-
but where login should still be enforced (e.g., profile page, personal area, etc.).
|
|
777
|
-
|
|
778
|
-
--- Behavior ---
|
|
779
|
-
1. If the user is **not authenticated**, Keycloak redirects them to the login flow.
|
|
780
|
-
2. If authentication fails or is denied, the user is redirected according to Keycloak's configured settings.
|
|
781
|
-
3. If authentication is successful, the user is redirected to 'redirectTo' (usually `/home`, `/dashboard`, etc.).
|
|
782
|
-
|
|
783
|
-
--- Parameters ---
|
|
784
|
-
|
|
785
|
-
@param {string} redirectTo - URL to redirect the user to after login.
|
|
786
|
-
|
|
787
|
-
--- Warning ---
|
|
788
|
-
|
|
789
|
-
The route handler callback is **never executed**, because the middleware will respond earlier
|
|
790
|
-
with a redirect or block the request.
|
|
791
|
-
|
|
792
|
-
✅ Usage example:
|
|
793
|
-
```js
|
|
794
|
-
|
|
795
|
-
app.get('/loginMiddleware', keycloakAdapter.loginMiddleware("/home"), (req, res) => {
|
|
796
|
-
// This section is never reached
|
|
797
|
-
res.send("If you see this message, something went wrong.");
|
|
798
|
-
});
|
|
799
|
-
|
|
800
|
-
```
|
|
801
|
-
|
|
802
|
-
|
|
803
|
-
### `logoutMiddleware(redirectTo)`
|
|
804
|
-
`logoutMiddleware` Middleware is used to **force user logout**, removing the local session
|
|
805
|
-
and redirecting the user to Keycloak's logout endpoint according to its configuration.
|
|
806
|
-
|
|
807
|
-
It is useful when:
|
|
808
|
-
- You want to completely log out the user,
|
|
809
|
-
- You want to **terminate the session on Keycloak** (not just locally),
|
|
810
|
-
- You want to redirect the user to a public page, such as a homepage, after logout.
|
|
811
|
-
|
|
812
|
-
--- Behavior ---
|
|
813
|
-
1. Retrieves the `id_token` of the authenticated user.
|
|
814
|
-
2. Constructs the Keycloak logout URL including the token and the redirect URL.
|
|
815
|
-
3. **Destroys the local Express session** (e.g., cookies, user data).
|
|
816
|
-
4. Redirects the user to the Keycloak logout URL, which in turn redirects to the provided URL.
|
|
817
|
-
|
|
818
|
-
--- Parameters ---
|
|
819
|
-
|
|
820
|
-
@param {string} redirectTo - URL to which the user will be redirected after complete logout.
|
|
821
|
-
|
|
822
|
-
✅ Usage example:
|
|
823
|
-
```js
|
|
824
|
-
|
|
825
|
-
app.get('/logoutMiddleware', keycloakAdapter.logoutMiddleware("http://localhost:3001/home"), (req, res) => {
|
|
826
|
-
// This section is never reached
|
|
827
|
-
// The middleware handles logout and redirection automatically
|
|
828
|
-
});
|
|
829
|
-
|
|
830
|
-
```
|
|
831
|
-
|
|
832
|
-
--- Note ---
|
|
833
|
-
- The middleware **never executes the route callback**, as it fully handles the response.
|
|
834
|
-
- The `redirectTo` parameter must match a **valid redirect URI** configured in Keycloak for the client.
|
|
835
|
-
|
|
836
|
-
--- Requirements ---
|
|
837
|
-
- The Keycloak client must have properly configured `Valid Redirect URIs`.
|
|
838
|
-
- The Express session must be active (e.g., `express-session` properly initialized).
|
|
839
|
-
|
|
840
|
-
|
|
841
|
-
## 🔧 Available Functions
|
|
842
|
-
|
|
843
|
-
### `login(req, res, redirectTo)`
|
|
844
|
-
`login` Function not a middleware, but a **classic synchronous function** that forces user authentication
|
|
845
|
-
via Keycloak and, if the user is not authenticated, redirects them to the login page.
|
|
846
|
-
After successful login, the user is redirected to the URL specified in the `redirectTo` parameter.
|
|
847
|
-
|
|
848
|
-
--- Differences from `loginMiddleware` ---
|
|
849
|
-
- `loginMiddleware` handles everything automatically **before** the route handler function.
|
|
850
|
-
- `login` instead is a function **that can be manually called inside the route handler**,
|
|
851
|
-
offering **greater control** over when and how login is enforced.
|
|
852
|
-
|
|
853
|
-
--- Parameters ---
|
|
854
|
-
|
|
855
|
-
- @param {Object} req - Express `Request` object
|
|
856
|
-
- @param {Object} res - Express `Response` object
|
|
857
|
-
- @param {string} redirectTo - URL to redirect the user to after successful login
|
|
858
|
-
|
|
859
|
-
--- Behavior ---
|
|
860
|
-
1. Attempts to protect the request using `keycloak.protect()`.
|
|
861
|
-
2. If the user **is authenticated**, it performs `res.redirect(redirectTo)`.
|
|
862
|
-
3. If **not authenticated**, Keycloak automatically handles redirection to the login page.
|
|
863
|
-
|
|
864
|
-
✅ Usage example:
|
|
865
|
-
```js
|
|
866
|
-
|
|
867
|
-
app.get('/login', (req, res) => {
|
|
868
|
-
// Your route logic
|
|
869
|
-
// ...
|
|
870
|
-
// Force authentication if necessary
|
|
871
|
-
keycloakAdapter.login(req, res, "/home");
|
|
872
|
-
});
|
|
873
|
-
|
|
874
|
-
```
|
|
875
|
-
|
|
876
|
-
--- Notes ---
|
|
877
|
-
- The function can be called **within an Express route**, allowing for custom conditional logic.
|
|
878
|
-
- Useful for scenarios where only certain conditions should trigger a login.
|
|
879
|
-
|
|
880
|
-
--- Requirements ---
|
|
881
|
-
- `Valid Redirect URIs` must include the URL passed to `redirectTo`.
|
|
882
|
-
|
|
883
|
-
### `logout(req, res, redirectTo)`
|
|
884
|
-
`logout` Function is not a middleware, but a **classic synchronous function** that forces the user to logout
|
|
885
|
-
via Keycloak. In addition to terminating the current session (if any), it generates the Keycloak
|
|
886
|
-
logout URL and redirects the user's browser to that address.
|
|
887
|
-
|
|
888
|
-
--- Differences from `logoutMiddleware` ---
|
|
889
|
-
- `logoutMiddleware` is designed to be used directly as middleware in the route definition.
|
|
890
|
-
- `logout` instead is a function **to be called inside the route**, useful for handling logout
|
|
891
|
-
**conditionally** or within more complex logic.
|
|
892
|
-
|
|
893
|
-
--- Parameters ---
|
|
894
|
-
- @param {Object} req - Express `Request` object
|
|
895
|
-
- @param {Object} res - Express `Response` object
|
|
896
|
-
- @param {string} redirectTo - URL to redirect the user after logout
|
|
897
|
-
|
|
898
|
-
--- Behavior ---
|
|
899
|
-
1. Retrieves the `id_token` from the current user's Keycloak token (if present).
|
|
900
|
-
2. Builds the logout URL using `keycloak.logoutUrl()`.
|
|
901
|
-
3. Destroys the user's Express session.
|
|
902
|
-
4. Redirects the user to the Keycloak logout URL, which in turn redirects to `redirectTo`.
|
|
903
|
-
|
|
904
|
-
✅ Usage example:
|
|
905
|
-
```js
|
|
906
|
-
|
|
907
|
-
app.get('/logout', (req, res) => {
|
|
908
|
-
// Any custom logic before logout
|
|
909
|
-
// ...
|
|
910
|
-
keycloakAdapter.logout(req, res, "http://localhost:3001/home");
|
|
911
|
-
});
|
|
912
|
-
|
|
913
|
-
```
|
|
914
|
-
|
|
915
|
-
--- Requirements ---
|
|
916
|
-
- The user must be authenticated with Keycloak and have a valid token in `req.kauth.grant`.
|
|
917
|
-
- The URL specified in `redirectTo` must be present in the `Valid Redirect URIs` in the Keycloak client.
|
|
918
|
-
|
|
919
|
-
---
|
|
920
|
-
|
|
921
|
-
|
|
922
|
-
## 🔧 Admin Functions
|
|
923
|
-
All administrative functions that rely on Keycloak's Admin API must be invoked using the
|
|
924
|
-
keycloakAdapter.kcAdminClient.{entity}.{function} pattern.
|
|
201
|
+
## 🔧 Available Admin Functions
|
|
202
|
+
All administrative functions that rely on Keycloak's Admin API must be invoked using the
|
|
203
|
+
KeycloakManager.{entity}.{function} pattern.
|
|
925
204
|
- {entyty} represents the type of resource you want to manage (e.g., users, roles, groups, clients).
|
|
926
205
|
- {function} is the specific operation you want to perform on that resource (e.g., find, create, update, del).
|
|
927
206
|
For example:
|
|
928
207
|
```js
|
|
208
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
929
209
|
// get all users of this client
|
|
930
210
|
// users is the entity you want to administer.
|
|
931
211
|
// find is the method used to retrieve the list of users.
|
|
932
|
-
|
|
212
|
+
KeycloakManager.users.find();
|
|
933
213
|
```
|
|
934
214
|
Credits to @keycloak/keycloak-admin-client.
|
|
935
215
|
This admin function is built on top of it. For more details, please refer to the official repository.
|
|
@@ -937,7 +217,7 @@ This admin function is built on top of it. For more details, please refer to the
|
|
|
937
217
|
### `entity realm`
|
|
938
218
|
The realms property provides access to all administrative operations related to Keycloak realms.
|
|
939
219
|
A realm in Keycloak is a fundamental concept that acts as an isolated tenant:
|
|
940
|
-
|
|
220
|
+
each realm manages its own set of users, roles, groups, and clients independently.
|
|
941
221
|
#### `entity realm functions`
|
|
942
222
|
|
|
943
223
|
##### `function create(realm-dictionary)`
|
|
@@ -947,11 +227,12 @@ This method accepts a realm representation object containing details such as is,
|
|
|
947
227
|
- realm-dictionary: is a JSON object that accepts filter parameters
|
|
948
228
|
- id:[required] The internal ID of the realm. If omitted, Keycloak uses the realm name as the ID.
|
|
949
229
|
- realm:[required] The name of the realm to create.
|
|
950
|
-
- Additional optional properties can be passed to configure the realm (e.g., enabled, displayName, etc.).
|
|
230
|
+
- { other fields }Additional optional properties can be passed to configure the realm (e.g., enabled, displayName, etc.).
|
|
951
231
|
|
|
952
232
|
```js
|
|
233
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
953
234
|
// create a new realm
|
|
954
|
-
const realm = await
|
|
235
|
+
const realm = await KeycloakManager.realms.create({
|
|
955
236
|
id: "realm-id",
|
|
956
237
|
realm: "realmName",
|
|
957
238
|
});
|
|
@@ -967,8 +248,9 @@ You can use this method to modify settings such as login behavior, themes, token
|
|
|
967
248
|
- realm properties that can be passed to update the realm (e.g., enabled, displayName, etc.).
|
|
968
249
|
|
|
969
250
|
```js
|
|
251
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
970
252
|
// update a realm
|
|
971
|
-
await
|
|
253
|
+
await KeycloakManager.realms.update(
|
|
972
254
|
{ realm: 'realm-name' },
|
|
973
255
|
{
|
|
974
256
|
displayName: "test",
|
|
@@ -985,20 +267,21 @@ This operation is irreversible and removes all users, clients, roles, groups, an
|
|
|
985
267
|
- realm:[required] The name of the realm to delete.
|
|
986
268
|
|
|
987
269
|
```js
|
|
270
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
988
271
|
// delete 'realmeName' realm
|
|
989
|
-
const realm = await
|
|
272
|
+
const realm = await KeycloakManager.realms.del({
|
|
990
273
|
realm: "realmName",
|
|
991
274
|
});
|
|
992
275
|
```
|
|
993
276
|
|
|
994
|
-
##### `function find(
|
|
277
|
+
##### `function find()`
|
|
995
278
|
Retrieves a list of all realms configured in the Keycloak server.
|
|
996
279
|
This includes basic metadata for each realm such as ID and display name, but not the full configuration details.
|
|
997
280
|
This method does not take any parameters.
|
|
998
|
-
|
|
999
281
|
```js
|
|
282
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1000
283
|
// delete 'realmeName' realm
|
|
1001
|
-
|
|
284
|
+
const realms = await KeycloakManager.realms.find();
|
|
1002
285
|
console.log("Retrieved realms:",realms);
|
|
1003
286
|
```
|
|
1004
287
|
|
|
@@ -1010,8 +293,9 @@ This includes settings like login policies, themes, password policies, etc.
|
|
|
1010
293
|
- realm:[required] The name (ID) of the realm you want to retrieve.
|
|
1011
294
|
|
|
1012
295
|
```js
|
|
296
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1013
297
|
// delete 'realmeName' realm
|
|
1014
|
-
|
|
298
|
+
const realmConfig = await KeycloakManager.realms.findOne({
|
|
1015
299
|
realm: "realmName",
|
|
1016
300
|
});
|
|
1017
301
|
console.log("Retrieved realm:",realmConfig);
|
|
@@ -1031,9 +315,10 @@ It’s useful for incremental updates or merging configuration pieces.
|
|
|
1031
315
|
- 'FAIL' – the operation fails if a resource already exists.
|
|
1032
316
|
- 'SKIP' – existing resources are skipped.
|
|
1033
317
|
- 'OVERWRITE' – existing resources are overwritten.
|
|
1034
|
-
- other configuration to be imported like users, roles, groups ...
|
|
318
|
+
- {other fields} other configuration to be imported like users, roles, groups ...
|
|
1035
319
|
|
|
1036
320
|
```js
|
|
321
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1037
322
|
// import configuration
|
|
1038
323
|
const roleToImport: PartialImportRealmRepresentation = {
|
|
1039
324
|
ifResourceExists: "FAIL",
|
|
@@ -1049,7 +334,7 @@ const roleToImport: PartialImportRealmRepresentation = {
|
|
|
1049
334
|
},
|
|
1050
335
|
};
|
|
1051
336
|
// partial realm import
|
|
1052
|
-
const result = await
|
|
337
|
+
const result = await KeycloakManager.realms.partialImport({
|
|
1053
338
|
realm: 'my-realm',
|
|
1054
339
|
rep: roleToImport,
|
|
1055
340
|
});
|
|
@@ -1065,9 +350,10 @@ This method returns the full realm representation in JSON format, including role
|
|
|
1065
350
|
- exportGroupsAndRoles: [optional] boolean, Whether to include groups and roles in the export. Default: true.
|
|
1066
351
|
|
|
1067
352
|
```js
|
|
353
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1068
354
|
|
|
1069
355
|
// realm export
|
|
1070
|
-
const exportedRealm = await
|
|
356
|
+
const exportedRealm = await KeycloakManager.realms.export({
|
|
1071
357
|
realm: 'my-realm',
|
|
1072
358
|
exportClients: true, // optional
|
|
1073
359
|
exportGroupsAndRoles: true, // optional
|
|
@@ -1084,9 +370,10 @@ These providers define how new clients can be registered and what rules or valid
|
|
|
1084
370
|
- realm:[required] The name of the realm where you want to list client registration policy providers.
|
|
1085
371
|
|
|
1086
372
|
```js
|
|
373
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1087
374
|
|
|
1088
375
|
// get Client Registration Policy Providers
|
|
1089
|
-
await
|
|
376
|
+
await KeycloakManager.realms.getClientRegistrationPolicyProviders({
|
|
1090
377
|
realm: currentRealmName,
|
|
1091
378
|
});
|
|
1092
379
|
```
|
|
@@ -1111,8 +398,9 @@ This token allows clients to register themselves with the realm using the Dynami
|
|
|
1111
398
|
- count: Maximum allowed uses
|
|
1112
399
|
- remainingCount: How many uses are left
|
|
1113
400
|
```js
|
|
401
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1114
402
|
// get Client Registration Policy Providers with oount=1 and unlimited expiration time
|
|
1115
|
-
const initialAccess= await
|
|
403
|
+
const initialAccess= await KeycloakManager.realms.realms.createClientsInitialAccess(
|
|
1116
404
|
{ realm: currentRealmName },
|
|
1117
405
|
{ count: 1, expiration: 0 },
|
|
1118
406
|
);
|
|
@@ -1135,8 +423,9 @@ These tokens are used to allow programmatic or automated registration of clients
|
|
|
1135
423
|
- count: Maximum allowed uses
|
|
1136
424
|
- remainingCount: How many uses are left
|
|
1137
425
|
```js
|
|
426
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1138
427
|
// get get Clients Initial Access list
|
|
1139
|
-
const tokens= await
|
|
428
|
+
const tokens= await KeycloakManager.realms.getClientsInitialAccess({ realm:'realm-id'});
|
|
1140
429
|
console.log("Initial Access Tokens:", tokens);
|
|
1141
430
|
```
|
|
1142
431
|
|
|
@@ -1150,8 +439,9 @@ This revokes the token, preventing any future use.
|
|
|
1150
439
|
- realm:[required] The name of the realm where the token was created.
|
|
1151
440
|
- id:[required] The ID of the initial access token you want to delete.
|
|
1152
441
|
```js
|
|
442
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1153
443
|
// delete Clients Initial Access
|
|
1154
|
-
await
|
|
444
|
+
await KeycloakManager.realms.delClientsInitialAccess({
|
|
1155
445
|
realm: 'realm-id',
|
|
1156
446
|
id: 'initial-access-token-id',
|
|
1157
447
|
});
|
|
@@ -1166,8 +456,9 @@ Users created in this realm will automatically be added to all default groups.
|
|
|
1166
456
|
- realm:[required] The name of the realm where the default group will be set.
|
|
1167
457
|
- id:[required] The ID of the group to be added as a default group
|
|
1168
458
|
```js
|
|
459
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1169
460
|
// get get Clients Initial Access list
|
|
1170
|
-
await
|
|
461
|
+
await KeycloakManager.realms.addDefaultGroup({
|
|
1171
462
|
realm: 'realm-id',
|
|
1172
463
|
id: 'default-group-id',
|
|
1173
464
|
});
|
|
@@ -1181,8 +472,9 @@ Default groups are automatically assigned to new users when they are created.
|
|
|
1181
472
|
- realm:[required] The name of the realm from which to remove the default group.
|
|
1182
473
|
- id:[required] The ID of the group you want to remove from the default list.
|
|
1183
474
|
```js
|
|
475
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1184
476
|
// remove from 'realm-id' the group 'default-group-id'
|
|
1185
|
-
await
|
|
477
|
+
await KeycloakManager.realms.removeDefaultGroup({
|
|
1186
478
|
realm: 'realm-id',
|
|
1187
479
|
id: 'default-group-id',
|
|
1188
480
|
});
|
|
@@ -1197,8 +489,9 @@ These are the groups that new users will automatically be added to upon creation
|
|
|
1197
489
|
- realm:[required] The name of the realm from which to retrieve default groups.
|
|
1198
490
|
|
|
1199
491
|
```js
|
|
492
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1200
493
|
// get 'realm-id' default groups
|
|
1201
|
-
const defaultGroups = await
|
|
494
|
+
const defaultGroups = await KeycloakManager.realms.getDefaultGroups({
|
|
1202
495
|
realm: 'realm-id',
|
|
1203
496
|
});
|
|
1204
497
|
console.log(defaultGroups);
|
|
@@ -1215,8 +508,9 @@ This is useful when you know the group’s full path (e.g., /parent/child) but n
|
|
|
1215
508
|
|
|
1216
509
|
|
|
1217
510
|
```js
|
|
511
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1218
512
|
// get 'realm-id' group by Path
|
|
1219
|
-
const defaultGroups = await
|
|
513
|
+
const defaultGroups = await KeycloakManager.realms.getGroupByPath({
|
|
1220
514
|
realm: 'realm-id',
|
|
1221
515
|
path: 'realm-name-path'
|
|
1222
516
|
});
|
|
@@ -1233,8 +527,9 @@ Useful for auditing and tracking activities inside Keycloak.
|
|
|
1233
527
|
- realmFilter: is a JSON object that accepts filter parameters
|
|
1234
528
|
- realm:[required] The name of the realm from which to retrieve the event configuration.
|
|
1235
529
|
```js
|
|
530
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1236
531
|
// get Config Events
|
|
1237
|
-
const config= await
|
|
532
|
+
const config= await KeycloakManager.realms.getConfigEvents({
|
|
1238
533
|
realm: 'realm-id',
|
|
1239
534
|
});
|
|
1240
535
|
console.log(config);
|
|
@@ -1265,8 +560,9 @@ enabling admin event logging, and choosing which event listeners to use.
|
|
|
1265
560
|
- adminEventsEnabled: Enables logging for admin events.
|
|
1266
561
|
- adminEventsDetailsEnabled: Includes full details in admin event logs if set to true.
|
|
1267
562
|
```js
|
|
563
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1268
564
|
// Update Config Events
|
|
1269
|
-
const config= await
|
|
565
|
+
const config= await KeycloakManager.realms.updateConfigEvents(
|
|
1270
566
|
{ realm: 'realm-id'},
|
|
1271
567
|
{
|
|
1272
568
|
eventsEnabled: true,
|
|
@@ -1294,9 +590,10 @@ Useful for auditing login, logout, and other user-related activities.
|
|
|
1294
590
|
- first: [optional] Pagination offset.
|
|
1295
591
|
- max: [optional] Maximum number of events to return.
|
|
1296
592
|
```js
|
|
593
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1297
594
|
|
|
1298
595
|
// find 10 realm-id events with a type=LOGIN and dateFrom and dateTo.
|
|
1299
|
-
const config= await
|
|
596
|
+
const config= await KeycloakManager.realms.findEvents({
|
|
1300
597
|
realm: 'realm-id',
|
|
1301
598
|
type: 'LOGIN',
|
|
1302
599
|
dateFrom: '2025-08-01T00:00:00Z',
|
|
@@ -1324,9 +621,10 @@ This is useful for auditing changes made via the admin API or admin console.
|
|
|
1324
621
|
- resourcePath: [optional] Filter events by resource path.
|
|
1325
622
|
- resourceTypes: [optional] Filter events by resource type (e.g., USER, REALM_ROLE, CLIENT).
|
|
1326
623
|
```js
|
|
624
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1327
625
|
|
|
1328
626
|
// find 10 realm-id admin events with a type=CREATE|DELETE and dateFrom and dateTo.
|
|
1329
|
-
const config= await
|
|
627
|
+
const config= await KeycloakManager.realms.findAdminEvents({
|
|
1330
628
|
realm: 'realm-id',
|
|
1331
629
|
operationTypes: ['CREATE', 'DELETE'],
|
|
1332
630
|
dateFrom: '2025-08-01T00:00:00Z',
|
|
@@ -1345,9 +643,10 @@ This does not clear administrative events. To remove those, use realms.clearAdmi
|
|
|
1345
643
|
- realmFilter: is a JSON object that accepts filter parameters
|
|
1346
644
|
- realm: [required] The name of the realm from which to clear user events.
|
|
1347
645
|
```js
|
|
646
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1348
647
|
|
|
1349
648
|
// clear realm-id events
|
|
1350
|
-
const config= await
|
|
649
|
+
const config= await KeycloakManager.realms.clearEvents({
|
|
1351
650
|
realm: 'realm-id',
|
|
1352
651
|
});
|
|
1353
652
|
```
|
|
@@ -1361,9 +660,10 @@ performed by administrators via the Admin Console or Admin REST API.
|
|
|
1361
660
|
- realmFilter: is a JSON object that accepts filter parameters
|
|
1362
661
|
- realm: [required] The name of the realm from which to clear administrative events.
|
|
1363
662
|
```js
|
|
663
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1364
664
|
|
|
1365
665
|
// clear realm-id admin events
|
|
1366
|
-
const config= await
|
|
666
|
+
const config= await KeycloakManager.realms.clearAdminEvents({
|
|
1367
667
|
realm: 'realm-id',
|
|
1368
668
|
});
|
|
1369
669
|
```
|
|
@@ -1380,6 +680,7 @@ This allows you to check whether user management operations (like creating, upda
|
|
|
1380
680
|
|
|
1381
681
|
Returns an object with information such as:
|
|
1382
682
|
```js
|
|
683
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1383
684
|
{
|
|
1384
685
|
enabled: boolean;
|
|
1385
686
|
resource: string;
|
|
@@ -1392,9 +693,10 @@ if enabled is false, user management operations are not restricted by fine-grain
|
|
|
1392
693
|
You can enable or configure these permissions using updateUsersManagementPermissions()
|
|
1393
694
|
|
|
1394
695
|
```js
|
|
696
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1395
697
|
|
|
1396
698
|
// Get Permissions
|
|
1397
|
-
const permissions= await
|
|
699
|
+
const permissions= await KeycloakManager.realms.getUsersManagementPermissions({
|
|
1398
700
|
realm: 'realm-id',
|
|
1399
701
|
});
|
|
1400
702
|
console.log(permissions.enabled); // true or false
|
|
@@ -1416,6 +718,7 @@ are protected using Keycloak's authorization services.
|
|
|
1416
718
|
|
|
1417
719
|
Returns an object with information such as:
|
|
1418
720
|
```js
|
|
721
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1419
722
|
{
|
|
1420
723
|
enabled: boolean;
|
|
1421
724
|
resource: string;
|
|
@@ -1426,8 +729,9 @@ Returns an object with information such as:
|
|
|
1426
729
|
```
|
|
1427
730
|
|
|
1428
731
|
```js
|
|
732
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1429
733
|
// Update Permissions
|
|
1430
|
-
const permissions= await
|
|
734
|
+
const permissions= await KeycloakManager.realms.updateUsersManagementPermissions({
|
|
1431
735
|
realm: 'realm-id',
|
|
1432
736
|
});
|
|
1433
737
|
|
|
@@ -1465,8 +769,9 @@ Returns a list of keys and related information:
|
|
|
1465
769
|
```
|
|
1466
770
|
|
|
1467
771
|
```js
|
|
772
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1468
773
|
// Get Keys
|
|
1469
|
-
const Keys= await
|
|
774
|
+
const Keys= await KeycloakManager.realms.getKeys({
|
|
1470
775
|
realm: 'realm-id',
|
|
1471
776
|
});
|
|
1472
777
|
|
|
@@ -1485,8 +790,9 @@ Retrieves statistics about active client sessions in the specified realm. This i
|
|
|
1485
790
|
Returns an array of objects, each representing a client with active sessions
|
|
1486
791
|
|
|
1487
792
|
```js
|
|
793
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1488
794
|
// Get Client Session Stats
|
|
1489
|
-
const stats= await
|
|
795
|
+
const stats= await KeycloakManager.realms.getClientSessionStats({
|
|
1490
796
|
realm: 'realm-id',
|
|
1491
797
|
});
|
|
1492
798
|
|
|
@@ -1510,8 +816,9 @@ This forces clients to revalidate tokens, effectively revoking cached access tok
|
|
|
1510
816
|
- realm: [required] The name of the realm where the revocation should be pushed.
|
|
1511
817
|
|
|
1512
818
|
```js
|
|
819
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1513
820
|
// push revocaiton to realm realm-id
|
|
1514
|
-
const pushR= await
|
|
821
|
+
const pushR= await KeycloakManager.realms.pushRevocation({
|
|
1515
822
|
realm: 'realm-id',
|
|
1516
823
|
});
|
|
1517
824
|
|
|
@@ -1528,8 +835,9 @@ This invalidates all user sessions, forcing every user to re-authenticate.
|
|
|
1528
835
|
- realm: [required] The name of the realm from which to log out all users.
|
|
1529
836
|
|
|
1530
837
|
```js
|
|
838
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1531
839
|
// force all users logout in realm realm-id
|
|
1532
|
-
const logout= await
|
|
840
|
+
const logout= await KeycloakManager.realms.logoutAll({
|
|
1533
841
|
realm: 'realm-id',
|
|
1534
842
|
});
|
|
1535
843
|
|
|
@@ -1555,9 +863,10 @@ fully integrating it into the realm configuration.
|
|
|
1555
863
|
- authType: [optional] Type of authentication; usually "simple" or "none".
|
|
1556
864
|
|
|
1557
865
|
```js
|
|
866
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1558
867
|
//should fail with invalid ldap settings
|
|
1559
868
|
try {
|
|
1560
|
-
await
|
|
869
|
+
await KeycloakManager.realms.testLDAPConnection(
|
|
1561
870
|
{ realm: "realm-name" },
|
|
1562
871
|
{
|
|
1563
872
|
action: "testConnection",
|
|
@@ -1595,9 +904,10 @@ such as supported controls, extensions, authentication mechanisms, and more.
|
|
|
1595
904
|
- authType: [optional] Type of authentication; usually "simple" or "none".
|
|
1596
905
|
|
|
1597
906
|
```js
|
|
907
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1598
908
|
// should fail with invalid ldap server capabilities
|
|
1599
909
|
try {
|
|
1600
|
-
await
|
|
910
|
+
await KeycloakManager.realms.ldapServerCapabilities(
|
|
1601
911
|
{ realm: "realm-name" },
|
|
1602
912
|
{
|
|
1603
913
|
action: "testConnection",
|
|
@@ -1638,9 +948,10 @@ SMTP server before applying the settings to the realm.
|
|
|
1638
948
|
- envelopeFrom [optional] Envelope sender address.
|
|
1639
949
|
|
|
1640
950
|
```js
|
|
951
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1641
952
|
// should fail with invalid smtp settings
|
|
1642
953
|
try {
|
|
1643
|
-
await
|
|
954
|
+
await KeycloakManager.realms.testSMTPConnection(
|
|
1644
955
|
{ realm: "master" },
|
|
1645
956
|
{
|
|
1646
957
|
from: "test@test.com",
|
|
@@ -1664,10 +975,10 @@ Localization texts are used to override default Keycloak UI messages for login f
|
|
|
1664
975
|
- filter: is a JSON object that accepts this filter parameters
|
|
1665
976
|
- realm: [required] The name of the realm from which to fetch localization texts.
|
|
1666
977
|
- selectedLocale: [required] The locale code (e.g., 'en', 'it', 'fr', etc.) for which you want to retrieve the translations.
|
|
1667
|
-
-
|
|
1668
978
|
```js
|
|
979
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1669
980
|
// Realm localization
|
|
1670
|
-
const texts= await
|
|
981
|
+
const texts= await KeycloakManager.realms.getRealmLocalizationTexts({
|
|
1671
982
|
realm: "realm-id",
|
|
1672
983
|
selectedLocale:'it'
|
|
1673
984
|
});
|
|
@@ -1687,8 +998,9 @@ This allows you to override default messages in the login screens and other UI c
|
|
|
1687
998
|
- key: [required] The message key or identifier to override (e.g., loginAccountTitle, errorInvalidUsername).
|
|
1688
999
|
- value: [required] The actual translated text to associate with the key for the given locale.
|
|
1689
1000
|
```js
|
|
1001
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1690
1002
|
// should add localization
|
|
1691
|
-
await
|
|
1003
|
+
await KeycloakManager.realms.addLocalization({
|
|
1692
1004
|
realm: "realm-id",
|
|
1693
1005
|
selectedLocale:'it',
|
|
1694
1006
|
key:"theKey"
|
|
@@ -1709,15 +1021,16 @@ This function is useful to determine which locales have at least one overridden
|
|
|
1709
1021
|
Return An array of locale codes (e.g., ["en", "it", "fr"]) representing the languages that have at least
|
|
1710
1022
|
one customized localization entry in the given realm.
|
|
1711
1023
|
```js
|
|
1024
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1712
1025
|
// should add localization
|
|
1713
|
-
await
|
|
1026
|
+
await KeycloakManager.realms.addLocalization({
|
|
1714
1027
|
realm: "realm-id",
|
|
1715
1028
|
selectedLocale:'it',
|
|
1716
1029
|
key:"theKey"
|
|
1717
1030
|
},"new Value String for key:theKey");
|
|
1718
1031
|
|
|
1719
1032
|
// should get localization for specified locale
|
|
1720
|
-
const specificLocales= await
|
|
1033
|
+
const specificLocales= await KeycloakManager.realms.getRealmSpecificLocales({
|
|
1721
1034
|
realm: "realm-id",
|
|
1722
1035
|
selectedLocale: "it",
|
|
1723
1036
|
});
|
|
@@ -1740,8 +1053,9 @@ This is useful when you want to remove a previously added or overridden message
|
|
|
1740
1053
|
Returns void if the deletion is successful. Will throw an error if the entry does not exist or if parameters are invalid.
|
|
1741
1054
|
|
|
1742
1055
|
```js
|
|
1056
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1743
1057
|
// should delete localization for specified locale key 'theKey'
|
|
1744
|
-
await
|
|
1058
|
+
await KeycloakManager.realms.deleteRealmLocalizationTexts({
|
|
1745
1059
|
realm: "realm-id",
|
|
1746
1060
|
selectedLocale: "it",
|
|
1747
1061
|
key:'theKey'
|
|
@@ -1764,8 +1078,9 @@ It is typically used when you want to programmatically add new users to your Key
|
|
|
1764
1078
|
@parameters:
|
|
1765
1079
|
- userRepresentation: An object containing the user fields to be updated.
|
|
1766
1080
|
```js
|
|
1081
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1767
1082
|
// create a new user
|
|
1768
|
-
const userProfile = await
|
|
1083
|
+
const userProfile = await KeycloakManager.users.create({
|
|
1769
1084
|
username:"username",
|
|
1770
1085
|
email: "test@keycloak.org",
|
|
1771
1086
|
// enabled required to be true in order to send actions email
|
|
@@ -1784,8 +1099,9 @@ sessions, and group/role memberships) are permanently deleted.
|
|
|
1784
1099
|
- id: [Required] the user ID to delete
|
|
1785
1100
|
- realm [Optional] the realm name (defaults to current realm)
|
|
1786
1101
|
```js
|
|
1102
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1787
1103
|
// delete a user
|
|
1788
|
-
const userProfile = await
|
|
1104
|
+
const userProfile = await KeycloakManager.users.del({
|
|
1789
1105
|
id: 'user-Id'
|
|
1790
1106
|
});
|
|
1791
1107
|
```
|
|
@@ -1800,18 +1116,19 @@ Searching by attributes is only available from Keycloak > 15
|
|
|
1800
1116
|
- max: A pagination parameter used to define the maximum number of users to return (limit).
|
|
1801
1117
|
- first: A pagination parameter used to define the number of users to skip before starting to return results (offset/limit).
|
|
1802
1118
|
```js
|
|
1119
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1803
1120
|
// find a user with 'key:value'
|
|
1804
|
-
const user = await
|
|
1121
|
+
const user = await KeycloakManager.users.find({ q: "key:value" });;
|
|
1805
1122
|
if(user) console.log('User found:', user);
|
|
1806
1123
|
else console.log('User not found');
|
|
1807
1124
|
|
|
1808
1125
|
// find a user by name = John
|
|
1809
|
-
user = await
|
|
1126
|
+
user = await KeycloakManager.users.find({ name: "John" });;
|
|
1810
1127
|
if(user) console.log('User found:', user);
|
|
1811
1128
|
else console.log('User not found');
|
|
1812
1129
|
|
|
1813
1130
|
// find a user with 'name:john', skip 10 users and limt to 5
|
|
1814
|
-
const user = await
|
|
1131
|
+
const user = await KeycloakManager.users.find({ q: "name:john", first:11, max:5});;
|
|
1815
1132
|
if(user) console.log('User found:', user);
|
|
1816
1133
|
else console.log('User not found');
|
|
1817
1134
|
```
|
|
@@ -1820,8 +1137,9 @@ else console.log('User not found');
|
|
|
1820
1137
|
findOne is method used to retrieve a specific user's details by their unique identifier (id) within a given realm.
|
|
1821
1138
|
It returns the full user representation if the user exists.
|
|
1822
1139
|
```js
|
|
1140
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1823
1141
|
// find a user with id:'user-id'
|
|
1824
|
-
const user = await
|
|
1142
|
+
const user = await KeycloakManager.users.findOne({ id: 'user-id' });
|
|
1825
1143
|
if(user) console.log('User found:', user);
|
|
1826
1144
|
else console.log('User not found');
|
|
1827
1145
|
```
|
|
@@ -1834,12 +1152,13 @@ Searching by attributes is only available from Keycloak > 15
|
|
|
1834
1152
|
@parameters:
|
|
1835
1153
|
- filter is a JSON object that accepts filter parameters, such as { email: 'test@keycloak.org' }
|
|
1836
1154
|
```js
|
|
1155
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1837
1156
|
// Return the total number of registered users
|
|
1838
|
-
const user_count = await
|
|
1157
|
+
const user_count = await KeycloakManager.users.count();
|
|
1839
1158
|
console.log('User found:', user_count);
|
|
1840
1159
|
|
|
1841
1160
|
// Return the number of users with the name "John"
|
|
1842
|
-
user_count = await
|
|
1161
|
+
user_count = await KeycloakManager.users.count({name:'Jhon'});
|
|
1843
1162
|
console.log('User found:', user_count);
|
|
1844
1163
|
```
|
|
1845
1164
|
|
|
@@ -1854,8 +1173,9 @@ You can modify fields like firstName, lastName, email, enabled, and more.
|
|
|
1854
1173
|
- realm [Optional] the realm name (defaults to current realm)
|
|
1855
1174
|
- userRepresentation: An object containing the user fields to be updated.
|
|
1856
1175
|
```js
|
|
1176
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1857
1177
|
// Update user with id:'user-id'
|
|
1858
|
-
const user_count = await
|
|
1178
|
+
const user_count = await KeycloakManager.users.update({ id: 'user-Id' }, {
|
|
1859
1179
|
firstName: 'John',
|
|
1860
1180
|
lastName: 'Updated',
|
|
1861
1181
|
enabled: true,
|
|
@@ -1876,8 +1196,9 @@ change the password on next login.
|
|
|
1876
1196
|
- value: a String containing new password to be set
|
|
1877
1197
|
|
|
1878
1198
|
```js
|
|
1199
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1879
1200
|
// Update user with id:'user-id'
|
|
1880
|
-
const user = await
|
|
1201
|
+
const user = await KeycloakManager.users.resetPassword({
|
|
1881
1202
|
id: userId,
|
|
1882
1203
|
credential:{
|
|
1883
1204
|
temporary: false,
|
|
@@ -1896,8 +1217,9 @@ or managing credentials such as password reset, WebAuthn deletion, etc.
|
|
|
1896
1217
|
- id: [Required] the user ID to update
|
|
1897
1218
|
- realm [Optional] the realm name (defaults to current realm)
|
|
1898
1219
|
```js
|
|
1220
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1899
1221
|
// get credentials info for user whose id is 'user-id'
|
|
1900
|
-
const ressult = await
|
|
1222
|
+
const ressult = await KeycloakManager.users.getCredentials({id: 'user-id'});
|
|
1901
1223
|
console.log(ressult);
|
|
1902
1224
|
```
|
|
1903
1225
|
|
|
@@ -1910,8 +1232,9 @@ This is useful when you want to invalidate or remove a credential, forcing the u
|
|
|
1910
1232
|
- id: [Required] the user ID to update
|
|
1911
1233
|
- credentialId [Required] the credentils identifier
|
|
1912
1234
|
```js
|
|
1235
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1913
1236
|
// delete credentials info for user whose id is 'user-id'
|
|
1914
|
-
const ressult = await
|
|
1237
|
+
const ressult = await KeycloakManager.users.deleteCredential({
|
|
1915
1238
|
id: 'user-id',
|
|
1916
1239
|
credentialId: credential.id
|
|
1917
1240
|
});
|
|
@@ -1922,8 +1245,9 @@ It is a method that retrieves the user profile dictionary information.
|
|
|
1922
1245
|
This includes basic user details such as username, email, first name, last name,
|
|
1923
1246
|
and other attributes associated with the user profile in the Keycloak realm.
|
|
1924
1247
|
```js
|
|
1248
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1925
1249
|
// Get user profile
|
|
1926
|
-
const userProfile = await
|
|
1250
|
+
const userProfile = await KeycloakManager.users.getProfile();
|
|
1927
1251
|
console.log('User profile dicionary:', userProfile);
|
|
1928
1252
|
```
|
|
1929
1253
|
|
|
@@ -1934,8 +1258,9 @@ Adds a user to a specific group within the realm.
|
|
|
1934
1258
|
- id [required]: The user ID of the user you want to add to the group.
|
|
1935
1259
|
- groupId [required]: The group ID of the group the user should be added to.
|
|
1936
1260
|
```js
|
|
1261
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1937
1262
|
// create a role name called my-role
|
|
1938
|
-
const userGroup = await
|
|
1263
|
+
const userGroup = await KeycloakManager.users.addToGroup({
|
|
1939
1264
|
groupId: 'group-id',
|
|
1940
1265
|
id: 'user-id',
|
|
1941
1266
|
});
|
|
@@ -1948,8 +1273,9 @@ Removes a user from a specific group in Keycloak.
|
|
|
1948
1273
|
- id [required]: The user ID of the user you want to remove to the group.
|
|
1949
1274
|
- groupId [required]: The group ID of the group the user should be removed to.
|
|
1950
1275
|
```js
|
|
1276
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1951
1277
|
// create a role name called my-role
|
|
1952
|
-
const userGroup = await
|
|
1278
|
+
const userGroup = await KeycloakManager.users.delFromGroup({
|
|
1953
1279
|
groupId: 'group-id',
|
|
1954
1280
|
id: 'user-id',
|
|
1955
1281
|
});
|
|
@@ -1963,8 +1289,9 @@ Retrieves the number of groups that a given user is a member of.
|
|
|
1963
1289
|
- id: [required] The user ID of the user whose group membership count you want to retrieve.
|
|
1964
1290
|
- search: [optional] a String containing group name such "cool-group",
|
|
1965
1291
|
```js
|
|
1292
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1966
1293
|
// Return the total number of user groups
|
|
1967
|
-
const user_count = await
|
|
1294
|
+
const user_count = await KeycloakManager.users.countGroups({id:'user-id'});
|
|
1968
1295
|
console.log('Groups found:', user_count);
|
|
1969
1296
|
|
|
1970
1297
|
```
|
|
@@ -1975,8 +1302,9 @@ Returns the list of groups that a given user is a member of.
|
|
|
1975
1302
|
- id: [required] The user ID of the user whose group membership you want to retrieve.
|
|
1976
1303
|
- search: [optional] a String containing group name such "cool-group",
|
|
1977
1304
|
```js
|
|
1305
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1978
1306
|
// Return the total number of user groups
|
|
1979
|
-
const user_count = await
|
|
1307
|
+
const user_count = await KeycloakManager.users.listGroups({id:'user-id'});
|
|
1980
1308
|
console.log('Groups found:', user_count);
|
|
1981
1309
|
|
|
1982
1310
|
```
|
|
@@ -1993,8 +1321,9 @@ Returns a promise that resolves when the roles are successfully assigned. No ret
|
|
|
1993
1321
|
- id: [required] The role Id
|
|
1994
1322
|
- name: [required] The role Name
|
|
1995
1323
|
```js
|
|
1324
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
1996
1325
|
// Assigns one realm-level role to a user whose ID is 'user-id'.
|
|
1997
|
-
const user_count = await
|
|
1326
|
+
const user_count = await KeycloakManager.users.addRealmRoleMappings({
|
|
1998
1327
|
id: 'user-id',
|
|
1999
1328
|
// at least id and name should appear
|
|
2000
1329
|
roles: [
|
|
@@ -2019,8 +1348,9 @@ This method does not affect composite roles. It only removes directly assigned r
|
|
|
2019
1348
|
- id: [required] The role Id
|
|
2020
1349
|
- name: [required] The role Name
|
|
2021
1350
|
```js
|
|
1351
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2022
1352
|
// remove one realm-level role to a user whose ID is 'user-id'.
|
|
2023
|
-
const roles_remove = await
|
|
1353
|
+
const roles_remove = await KeycloakManager.users.delRealmRoleMappings({
|
|
2024
1354
|
id: 'user-id',
|
|
2025
1355
|
// at least id and name should appear
|
|
2026
1356
|
roles: [
|
|
@@ -2043,8 +1373,9 @@ These are the roles that exist in the realm but have not yet been mapped to the
|
|
|
2043
1373
|
- filter is a JSON object that accepts this parameters:
|
|
2044
1374
|
- id: [required] The ID of the user for whom to list assignable realm roles.
|
|
2045
1375
|
```js
|
|
1376
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2046
1377
|
// Get assignable realm-level roles for user 'user-id'.
|
|
2047
|
-
const available_roles = await
|
|
1378
|
+
const available_roles = await KeycloakManager.users.listAvailableRealmRoleMappings({
|
|
2048
1379
|
id: 'user-id',
|
|
2049
1380
|
});
|
|
2050
1381
|
console.log('Assignable realm-level roles for user user-id',available_roles);
|
|
@@ -2062,8 +1393,9 @@ Retrieves all realm-level and client-level roles that are currently assigned to
|
|
|
2062
1393
|
- clientMappings: object containing client roles grouped by client.
|
|
2063
1394
|
|
|
2064
1395
|
```js
|
|
1396
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2065
1397
|
// Get assigned roles for user 'user-id'.
|
|
2066
|
-
const roleMappings = await
|
|
1398
|
+
const roleMappings = await KeycloakManager.users.listRoleMappings({
|
|
2067
1399
|
id: 'user-id',
|
|
2068
1400
|
});
|
|
2069
1401
|
console.log(`Realm Roles assigned to user-id:`);
|
|
@@ -2094,8 +1426,9 @@ Unlike listRoleMappings, this method focuses only on realm roles and excludes cl
|
|
|
2094
1426
|
|
|
2095
1427
|
|
|
2096
1428
|
```js
|
|
1429
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2097
1430
|
// Get assigned roles for user 'user-id'.
|
|
2098
|
-
const roleMappings = await
|
|
1431
|
+
const roleMappings = await KeycloakManager.users.listRealmRoleMappings({
|
|
2099
1432
|
id: 'user-id',
|
|
2100
1433
|
});
|
|
2101
1434
|
console.log(`Realm roles assigned to user user-id:`);
|
|
@@ -2117,8 +1450,9 @@ Composite roles include both directly assigned realm roles and any roles inherit
|
|
|
2117
1450
|
|
|
2118
1451
|
|
|
2119
1452
|
```js
|
|
1453
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2120
1454
|
// Get assigned roles for user 'user-id'.
|
|
2121
|
-
const roleMappings = await
|
|
1455
|
+
const roleMappings = await KeycloakManager.users.listCompositeRealmRoleMappings({
|
|
2122
1456
|
id: 'user-id',
|
|
2123
1457
|
});
|
|
2124
1458
|
console.log(`Composite realm roles assigned to user user-id:`);
|
|
@@ -2143,8 +1477,9 @@ allowing the user to have permissions defined by those client roles.
|
|
|
2143
1477
|
- [optional] Other fields
|
|
2144
1478
|
|
|
2145
1479
|
```js
|
|
1480
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2146
1481
|
// Add client roles for user 'user-id'.
|
|
2147
|
-
const roleMappings = await
|
|
1482
|
+
const roleMappings = await KeycloakManager.users.addClientRoleMappings({
|
|
2148
1483
|
id: 'user-id',
|
|
2149
1484
|
clientUniqueId: 'internal-client-id',
|
|
2150
1485
|
|
|
@@ -2166,9 +1501,10 @@ This is useful for determining which roles can still be mapped to the user.
|
|
|
2166
1501
|
- id: [required] The ID of the user
|
|
2167
1502
|
- clientUniqueId:[required] The internal ID of the client (not the clientId string)
|
|
2168
1503
|
```js
|
|
1504
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2169
1505
|
|
|
2170
1506
|
// Get all user 'user-id' available roles for client 'internal-client-id'
|
|
2171
|
-
const availableRoles = await
|
|
1507
|
+
const availableRoles = await KeycloakManager.users.listAvailableClientRoleMappings({
|
|
2172
1508
|
id: 'user-id',
|
|
2173
1509
|
clientUniqueId: 'internal-client-id'
|
|
2174
1510
|
});
|
|
@@ -2187,9 +1523,10 @@ This method returns not only directly assigned roles, but also roles inherited t
|
|
|
2187
1523
|
- id: [required] The ID of the user
|
|
2188
1524
|
- clientUniqueId:[required] The internal ID of the client (not the clientId string)
|
|
2189
1525
|
```js
|
|
1526
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2190
1527
|
|
|
2191
1528
|
// Get all composite roles assigned to a user 'user-id' for client 'internal-client-id'
|
|
2192
|
-
const availableRoles = await
|
|
1529
|
+
const availableRoles = await KeycloakManager.users.listCompositeClientRoleMappings({
|
|
2193
1530
|
id: 'user-id',
|
|
2194
1531
|
clientUniqueId: 'internal-client-id'
|
|
2195
1532
|
});
|
|
@@ -2208,9 +1545,10 @@ assigned to the user from the client, without including roles inherited via comp
|
|
|
2208
1545
|
- id: [required] The ID of the user
|
|
2209
1546
|
- clientUniqueId:[required] The internal ID of the client (not the clientId string)
|
|
2210
1547
|
```js
|
|
1548
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2211
1549
|
|
|
2212
1550
|
// Get all roles assigned to a user 'user-id' for client 'internal-client-id'
|
|
2213
|
-
const availableRoles = await
|
|
1551
|
+
const availableRoles = await KeycloakManager.users.listClientRoleMappings({
|
|
2214
1552
|
id: 'user-id',
|
|
2215
1553
|
clientUniqueId: 'internal-client-id'
|
|
2216
1554
|
});
|
|
@@ -2231,9 +1569,10 @@ This operation unlinks the direct association between the user and the specified
|
|
|
2231
1569
|
- name:[required]: role name
|
|
2232
1570
|
- [optional] Other fields
|
|
2233
1571
|
```js
|
|
1572
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2234
1573
|
|
|
2235
1574
|
// Get all roles assigned to a user 'user-id' for client 'internal-client-id'
|
|
2236
|
-
await
|
|
1575
|
+
await KeycloakManager.users.delClientRoleMappings({
|
|
2237
1576
|
id: 'user-id',
|
|
2238
1577
|
clientUniqueId: 'internal-client-id',
|
|
2239
1578
|
roles: [{
|
|
@@ -2255,9 +1594,10 @@ Each session represents a login session associated with that user across differe
|
|
|
2255
1594
|
- id: [required] The ID of the user whose sessions will be listed.
|
|
2256
1595
|
- clientId: [optional] The internal ID of the client that owns the roles.
|
|
2257
1596
|
```js
|
|
1597
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2258
1598
|
|
|
2259
1599
|
// Get all the user 'user-id' sessions.
|
|
2260
|
-
const sessions=await
|
|
1600
|
+
const sessions=await KeycloakManager.users.listSessions({
|
|
2261
1601
|
id: 'user-id',
|
|
2262
1602
|
});
|
|
2263
1603
|
console.log("User 'user-id' sessions:",sessions);
|
|
@@ -2275,9 +1615,10 @@ without requiring the user to be actively logged in.
|
|
|
2275
1615
|
- id: [required] The ID of the user whose sessions will be listeds
|
|
2276
1616
|
- clientId: [optional] The client ID whose sessions are being checked
|
|
2277
1617
|
```js
|
|
1618
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2278
1619
|
|
|
2279
1620
|
// Get all the user 'user-id' sessions.
|
|
2280
|
-
const sessions=await
|
|
1621
|
+
const sessions=await KeycloakManager.users.listOfflineSessions({
|
|
2281
1622
|
id: 'user-id',
|
|
2282
1623
|
clientId: 'client-id'
|
|
2283
1624
|
});
|
|
@@ -2294,9 +1635,10 @@ This invalidates the user’s active sessions and tokens, effectively logging th
|
|
|
2294
1635
|
- filter is a JSON object that accepts this parameters:
|
|
2295
1636
|
- id: [required] The ID of the user whose sessions will be closed
|
|
2296
1637
|
```js
|
|
1638
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2297
1639
|
|
|
2298
1640
|
// Get all the user 'user-id' sessions.
|
|
2299
|
-
const sessions=await
|
|
1641
|
+
const sessions=await KeycloakManager.users.logout({
|
|
2300
1642
|
id: 'user-id',
|
|
2301
1643
|
});
|
|
2302
1644
|
console.log('All User session closed');
|
|
@@ -2311,9 +1653,10 @@ Each consent represents a client application that the user has authorized to acc
|
|
|
2311
1653
|
- filter is a JSON object that accepts this parameters:
|
|
2312
1654
|
- id: [required] The ID of the user whose client consents can be retrieved.
|
|
2313
1655
|
```js
|
|
1656
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2314
1657
|
|
|
2315
1658
|
// Retrieves the list of OAuth2 client consents that the specified user has granted.
|
|
2316
|
-
const listConsents=await
|
|
1659
|
+
const listConsents=await KeycloakManager.users.listConsents({
|
|
2317
1660
|
id: 'user-id',
|
|
2318
1661
|
});
|
|
2319
1662
|
console.log('All User consents:',listConsents);
|
|
@@ -2332,9 +1675,10 @@ effectively disconnecting the client from the user's account and invalidating as
|
|
|
2332
1675
|
- id: [required] The ID of the user whose consent should be revoked
|
|
2333
1676
|
- clientId: TThe client ID for which the consent should be revoked
|
|
2334
1677
|
```js
|
|
1678
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2335
1679
|
|
|
2336
1680
|
// Retrieves the list of OAuth2 client consents that the specified user has granted.
|
|
2337
|
-
await
|
|
1681
|
+
await KeycloakManager.users.revokeConsent({
|
|
2338
1682
|
id: 'user-id',
|
|
2339
1683
|
clientId: 'client-id',
|
|
2340
1684
|
});
|
|
@@ -2353,9 +1697,10 @@ Returns an object containing a redirect URL or token used to impersonate the use
|
|
|
2353
1697
|
- filter is a JSON object that accepts this parameters:
|
|
2354
1698
|
- id: [required] The ID of the user to impersonate.
|
|
2355
1699
|
```js
|
|
1700
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2356
1701
|
|
|
2357
1702
|
// Impersonate a user whose id is 'user-id'
|
|
2358
|
-
await
|
|
1703
|
+
await KeycloakManager.users.impersonation({id: 'user-id'},{
|
|
2359
1704
|
user: 'user-id',
|
|
2360
1705
|
realm: 'realmeName'
|
|
2361
1706
|
});
|
|
@@ -2371,9 +1716,10 @@ This is useful if the user has linked their account with external providers like
|
|
|
2371
1716
|
- filter is a JSON object that accepts this parameters:
|
|
2372
1717
|
- id: [required] The unique ID of the user for whom you want to fetch the federated identities.
|
|
2373
1718
|
```js
|
|
1719
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2374
1720
|
|
|
2375
1721
|
// This will return a list of all identity providers that the user has linked to their Keycloak account.
|
|
2376
|
-
const federatedIdentities= await
|
|
1722
|
+
const federatedIdentities= await KeycloakManager.users.listFederatedIdentities({id: 'user-id'});
|
|
2377
1723
|
console.log("Federated Identities:", federatedIdentities);
|
|
2378
1724
|
```
|
|
2379
1725
|
|
|
@@ -2392,6 +1738,7 @@ This is typically used to associate a federated identity (such as a Google or Fa
|
|
|
2392
1738
|
- userId: [required] The ID of the user in the external identity provider.
|
|
2393
1739
|
- userName: [required] The username in the external identity provider.
|
|
2394
1740
|
```js
|
|
1741
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2395
1742
|
|
|
2396
1743
|
// Add user whose id is 'user-id' to a deferated 'federatedIdentity-Id'
|
|
2397
1744
|
const federatedIdentity = {
|
|
@@ -2399,7 +1746,7 @@ This is typically used to associate a federated identity (such as a Google or Fa
|
|
|
2399
1746
|
userId: "user-id",
|
|
2400
1747
|
userName: "username",
|
|
2401
1748
|
};
|
|
2402
|
-
await
|
|
1749
|
+
await KeycloakManager.users.addToFederatedIdentity({
|
|
2403
1750
|
id: 'user-id',
|
|
2404
1751
|
federatedIdentityId: "federatedIdentity-Id",
|
|
2405
1752
|
federatedIdentity:federatedIdentity,
|
|
@@ -2417,9 +1764,10 @@ This operation dissociates the external identity (e.g., a Google or Facebook acc
|
|
|
2417
1764
|
- id: [required] The ID of the Keycloak user from whom the federated identity should be removed.
|
|
2418
1765
|
- federatedIdentityId: [required] The alias of the identity provider (e.g., "google" or "facebook").
|
|
2419
1766
|
```js
|
|
1767
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2420
1768
|
|
|
2421
1769
|
// Remove a user whose id is 'user-id' from federated 'federatedIdentity-Id'
|
|
2422
|
-
await
|
|
1770
|
+
await KeycloakManager.users.delFromFederatedIdentity({
|
|
2423
1771
|
id: 'user-id',
|
|
2424
1772
|
federatedIdentityId: "federatedIdentity-Id",
|
|
2425
1773
|
});
|
|
@@ -2457,8 +1805,9 @@ Creates a new client with the provided configuration
|
|
|
2457
1805
|
- ....[optional] Other client fields
|
|
2458
1806
|
|
|
2459
1807
|
```js
|
|
1808
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2460
1809
|
// create a client called my-client
|
|
2461
|
-
const client= await
|
|
1810
|
+
const client= await KeycloakManager.clients.create({name: "my-client", id:"client-id"});
|
|
2462
1811
|
console.log("New Client Created:", client);
|
|
2463
1812
|
```
|
|
2464
1813
|
|
|
@@ -2474,8 +1823,9 @@ for a specific one using filters like clientId.
|
|
|
2474
1823
|
- first:[optional] Pagination: index of the first result to return.
|
|
2475
1824
|
- max:[optional] Pagination: maximum number of results to return.
|
|
2476
1825
|
```js
|
|
1826
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2477
1827
|
// Get client by ID: 'client-id'
|
|
2478
|
-
const clients= await
|
|
1828
|
+
const clients= await KeycloakManager.clients.find({ clientId:"client-id"});
|
|
2479
1829
|
console.log("Clients:", clients);
|
|
2480
1830
|
```
|
|
2481
1831
|
|
|
@@ -2486,8 +1836,9 @@ This method fetches the client’s configuration, including its settings, roles,
|
|
|
2486
1836
|
- filter: A JSON structure used to filter results based on specific fields:
|
|
2487
1837
|
- id: [optional] The unique identifier of the client to retrieve
|
|
2488
1838
|
```js
|
|
1839
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2489
1840
|
// Get client by ID: 'client-id'
|
|
2490
|
-
const clients= await
|
|
1841
|
+
const clients= await KeycloakManager.clients.findOne({ id:"client-id"});
|
|
2491
1842
|
console.log("Clients:", clients);
|
|
2492
1843
|
```
|
|
2493
1844
|
|
|
@@ -2499,8 +1850,9 @@ This operation is irreversible and will remove the client and all its associated
|
|
|
2499
1850
|
- filter: A JSON structure used to filter results based on specific fields:
|
|
2500
1851
|
- id: [required] The internal ID of the client to delete (not clientId)
|
|
2501
1852
|
```js
|
|
1853
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2502
1854
|
// delete client by ID: 'internal-client-id'
|
|
2503
|
-
const clients= await
|
|
1855
|
+
const clients= await KeycloakManager.clients.del({ id:"internal-client-id"});
|
|
2504
1856
|
console.log(`Client successfully deleted.`);
|
|
2505
1857
|
```
|
|
2506
1858
|
|
|
@@ -2513,8 +1865,9 @@ You can modify various attributes such as the client name, redirect URIs, protoc
|
|
|
2513
1865
|
- id: [required] The unique ID of the client you want to update
|
|
2514
1866
|
- clientRepresentation: [required] The new configuration for the client
|
|
2515
1867
|
```js
|
|
1868
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2516
1869
|
// update single client
|
|
2517
|
-
await
|
|
1870
|
+
await KeycloakManager.clients.update(
|
|
2518
1871
|
{ id:"internal-client-id"},
|
|
2519
1872
|
{
|
|
2520
1873
|
// clientId is required in client update
|
|
@@ -2539,8 +1892,9 @@ for fine-grained access control within that client.
|
|
|
2539
1892
|
- description: [optional] Optional description of the role.
|
|
2540
1893
|
- [optional] Other role fields
|
|
2541
1894
|
```js
|
|
1895
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2542
1896
|
// Creates a new client role under a specific client.
|
|
2543
|
-
const role= await
|
|
1897
|
+
const role= await KeycloakManager.clients.createRole({
|
|
2544
1898
|
id: 'client-id',
|
|
2545
1899
|
name: 'roleName'
|
|
2546
1900
|
});
|
|
@@ -2559,8 +1913,9 @@ This is useful when you want to inspect or verify the properties of a role defin
|
|
|
2559
1913
|
- roleName: [required] The name of the client role you want to find.
|
|
2560
1914
|
|
|
2561
1915
|
```js
|
|
1916
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2562
1917
|
// Get client role by ID: 'internal-client-id'
|
|
2563
|
-
const role= await
|
|
1918
|
+
const role= await KeycloakManager.clients.findRole({
|
|
2564
1919
|
id: 'internal-client-id',
|
|
2565
1920
|
roleName:'roleName'
|
|
2566
1921
|
});
|
|
@@ -2577,8 +1932,9 @@ This includes changing the role's name, description, or any associated metadata.
|
|
|
2577
1932
|
- roleName: [required] The name of the client role you want to update
|
|
2578
1933
|
- roleRepresentation: [required] An object with the updated properties of the role
|
|
2579
1934
|
```js
|
|
1935
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2580
1936
|
// update the client role
|
|
2581
|
-
await
|
|
1937
|
+
await KeycloakManager.clients.updateRole(
|
|
2582
1938
|
{ id: 'internal-client-id', roleName:'roleName'},
|
|
2583
1939
|
{
|
|
2584
1940
|
name: 'newName',
|
|
@@ -2600,8 +1956,9 @@ If the role does not exist or the operation fails, an error will be thrown.
|
|
|
2600
1956
|
- roleName: [required] The name of the client role you want to delete.
|
|
2601
1957
|
|
|
2602
1958
|
```js
|
|
1959
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2603
1960
|
// delere client role by ID: 'internal-client-id'
|
|
2604
|
-
const role= await
|
|
1961
|
+
const role= await KeycloakManager.clients.delRole({
|
|
2605
1962
|
id: 'internal-client-id',
|
|
2606
1963
|
roleName:'roleName'
|
|
2607
1964
|
});
|
|
@@ -2616,8 +1973,9 @@ These roles can be used to assign permissions to users or groups for the specifi
|
|
|
2616
1973
|
- id: [required] The internal ID of the client (not clientId)
|
|
2617
1974
|
|
|
2618
1975
|
```js
|
|
1976
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2619
1977
|
// list the client role
|
|
2620
|
-
const roles= await
|
|
1978
|
+
const roles= await KeycloakManager.clients.listRoles({
|
|
2621
1979
|
id: 'internal-client-id'
|
|
2622
1980
|
});
|
|
2623
1981
|
console.log("Client roles:", roles);
|
|
@@ -2632,8 +1990,9 @@ This is typically used for clients using client_credentials or authorization_cod
|
|
|
2632
1990
|
- id: [required] The internal ID of the client (not clientId)
|
|
2633
1991
|
|
|
2634
1992
|
```js
|
|
1993
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2635
1994
|
// get client secret
|
|
2636
|
-
const secret= await
|
|
1995
|
+
const secret= await KeycloakManager.clients.getClientSecret({
|
|
2637
1996
|
id: 'internal-client-id'
|
|
2638
1997
|
});
|
|
2639
1998
|
console.log("Client secret:", secret);
|
|
@@ -2649,8 +2008,9 @@ It is useful when rotating credentials or recovering access.
|
|
|
2649
2008
|
- id: [required] The internal ID of the client (not clientId)
|
|
2650
2009
|
|
|
2651
2010
|
```js
|
|
2011
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2652
2012
|
// generate new client secret
|
|
2653
|
-
const secret= await
|
|
2013
|
+
const secret= await KeycloakManager.clients.generateNewClientSecret({
|
|
2654
2014
|
id: 'internal-client-id'
|
|
2655
2015
|
});
|
|
2656
2016
|
|
|
@@ -2666,8 +2026,9 @@ It’s particularly useful in dynamic client registration workflows or when auto
|
|
|
2666
2026
|
- id: [required] The internal ID of the client (not clientId)
|
|
2667
2027
|
|
|
2668
2028
|
```js
|
|
2029
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2669
2030
|
// generate new registration access token
|
|
2670
|
-
const result= await
|
|
2031
|
+
const result= await KeycloakManager.clients.generateRegistrationAccessToken({
|
|
2671
2032
|
id: 'internal-client-id'
|
|
2672
2033
|
});
|
|
2673
2034
|
|
|
@@ -2684,8 +2045,9 @@ After invalidation, the client will no longer be able to authenticate using the
|
|
|
2684
2045
|
- id: [required] The internal ID of the client (not clientId)
|
|
2685
2046
|
|
|
2686
2047
|
```js
|
|
2048
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2687
2049
|
// invalidate rotation token
|
|
2688
|
-
await
|
|
2050
|
+
await KeycloakManager.clients.invalidateSecret({
|
|
2689
2051
|
id: 'internal-client-id'
|
|
2690
2052
|
});
|
|
2691
2053
|
console.log("Client secret invalidated successfully.");
|
|
@@ -2704,8 +2066,9 @@ for example as a JSON file, Keycloak XML adapter config, or other formats suppor
|
|
|
2704
2066
|
|
|
2705
2067
|
Return an array of installation provider objects, each representing a supported installation format for the client.
|
|
2706
2068
|
```js
|
|
2069
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2707
2070
|
// get installation providers
|
|
2708
|
-
const providers = await
|
|
2071
|
+
const providers = await KeycloakManager.clients.getInstallationProviders({
|
|
2709
2072
|
id: 'internal-client-id'
|
|
2710
2073
|
});
|
|
2711
2074
|
console.log("Available installation providers:", providers);
|
|
@@ -2722,8 +2085,9 @@ This method allows you to see which policy types are supported and available to
|
|
|
2722
2085
|
- id: [required] The ID of the client (resource server) for which to list available policy providers.
|
|
2723
2086
|
|
|
2724
2087
|
```js
|
|
2088
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2725
2089
|
// get installation providers
|
|
2726
|
-
const providers = await
|
|
2090
|
+
const providers = await KeycloakManager.clients.listPolicyProviders({
|
|
2727
2091
|
id: 'internal-client-id'
|
|
2728
2092
|
});
|
|
2729
2093
|
console.log("Available policy providers:", providers);
|
|
@@ -2743,8 +2107,9 @@ which can be used for token-based access and permissions management.
|
|
|
2743
2107
|
Return an object representing the user linked to the client's service account,
|
|
2744
2108
|
including details such as user ID, username, email, and other user attributes.
|
|
2745
2109
|
```js
|
|
2110
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2746
2111
|
// get service account user
|
|
2747
|
-
const serviceAccountUser = await
|
|
2112
|
+
const serviceAccountUser = await KeycloakManager.clients.getServiceAccountUser({
|
|
2748
2113
|
id: 'internal-client-id'
|
|
2749
2114
|
});
|
|
2750
2115
|
console.log("Service Account User:", serviceAccountUser);
|
|
@@ -2761,8 +2126,9 @@ Default scopes are automatically included in tokens issued to the client.
|
|
|
2761
2126
|
- clientScopeId: [required] The ID of the client scope you want to add as a default scope.
|
|
2762
2127
|
|
|
2763
2128
|
```js
|
|
2129
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2764
2130
|
// add default client scope
|
|
2765
|
-
await
|
|
2131
|
+
await KeycloakManager.clients.addDefaultClientScope({
|
|
2766
2132
|
id: 'internal-client-id',
|
|
2767
2133
|
clientScopeId:'client-scope-id'
|
|
2768
2134
|
});
|
|
@@ -2779,8 +2145,9 @@ Default scopes are automatically assigned to tokens issued for the client.
|
|
|
2779
2145
|
- clientScopeId: [required] The ID of the client scope to be removed.
|
|
2780
2146
|
|
|
2781
2147
|
```js
|
|
2148
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2782
2149
|
// cleanup default scopes
|
|
2783
|
-
await
|
|
2150
|
+
await KeycloakManager.clients.delDefaultClientScope({
|
|
2784
2151
|
id: 'internal-client-id',
|
|
2785
2152
|
clientScopeId:'client-scope-id'
|
|
2786
2153
|
});
|
|
@@ -2796,8 +2163,9 @@ Optional client scopes are those that are not automatically assigned to clients
|
|
|
2796
2163
|
- clientScopeId: [required] The ID of the client scope you want to unlink from the client.
|
|
2797
2164
|
|
|
2798
2165
|
```js
|
|
2166
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2799
2167
|
// cleanup default scopes
|
|
2800
|
-
await
|
|
2168
|
+
await KeycloakManager.clients.delOptionalClientScope({
|
|
2801
2169
|
id: 'internal-client-id',
|
|
2802
2170
|
clientScopeId:'client-scope-id'
|
|
2803
2171
|
});
|
|
@@ -2813,8 +2181,9 @@ Default client scopes are automatically assigned to a client during token reques
|
|
|
2813
2181
|
- id: [required] The client ID of the client whose default client scopes you want to list.
|
|
2814
2182
|
|
|
2815
2183
|
```js
|
|
2184
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2816
2185
|
// list default client scopes
|
|
2817
|
-
const defaultScopes = await
|
|
2186
|
+
const defaultScopes = await KeycloakManager.clients.listDefaultClientScopes({
|
|
2818
2187
|
id: 'internal-client-id',
|
|
2819
2188
|
});
|
|
2820
2189
|
console.log("Default Clients Scopes:",defaultScopes);
|
|
@@ -2832,8 +2201,9 @@ Optional scopes are those that a client can request explicitly but are not autom
|
|
|
2832
2201
|
- id: [required] The client ID of the client whose optional client scopes you want to list.
|
|
2833
2202
|
|
|
2834
2203
|
```js
|
|
2204
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2835
2205
|
// list optional client scopes
|
|
2836
|
-
const optionalScopes = await
|
|
2206
|
+
const optionalScopes = await KeycloakManager.clients.listOptionalClientScopes({
|
|
2837
2207
|
id: 'internal-client-id',
|
|
2838
2208
|
});
|
|
2839
2209
|
console.log("Optional Clients Scopes:",optionalScopes);
|
|
@@ -2850,8 +2220,9 @@ Optional scopes are not automatically applied during login unless explicitly req
|
|
|
2850
2220
|
- clientScopeId: [required] The ID of the client scope you want to assign as optional.
|
|
2851
2221
|
|
|
2852
2222
|
```js
|
|
2223
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2853
2224
|
// add optional client scope
|
|
2854
|
-
await
|
|
2225
|
+
await KeycloakManager.clients.addOptionalClientScope({
|
|
2855
2226
|
id: 'internal-client-id',
|
|
2856
2227
|
clientScopeId: 'scope-id',
|
|
2857
2228
|
});
|
|
@@ -2867,9 +2238,10 @@ This includes realm-level roles and client-level roles that are mapped to the cl
|
|
|
2867
2238
|
- id: [required] The ID of the client whose scope mappings you want to list.
|
|
2868
2239
|
|
|
2869
2240
|
```js
|
|
2241
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2870
2242
|
|
|
2871
2243
|
// get 'internal-client-id' scope mapping
|
|
2872
|
-
const scopeMappings = await
|
|
2244
|
+
const scopeMappings = await KeycloakManager.clients.listScopeMappings({
|
|
2873
2245
|
id: 'internal-client-id'
|
|
2874
2246
|
});
|
|
2875
2247
|
|
|
@@ -2889,9 +2261,10 @@ This helps you discover which client roles you can still add as scope mappings.
|
|
|
2889
2261
|
- client: [required] The client ID of the source client (the one that owns the roles to be mapped).
|
|
2890
2262
|
|
|
2891
2263
|
```js
|
|
2264
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2892
2265
|
|
|
2893
2266
|
// get 'internal-client-id' available roles to be mapped
|
|
2894
|
-
const availableRoles = await
|
|
2267
|
+
const availableRoles = await KeycloakManager.clients.listAvailableClientScopeMappings({
|
|
2895
2268
|
id: 'internal-client-id',
|
|
2896
2269
|
client: 'internal-client-id',
|
|
2897
2270
|
});
|
|
@@ -2915,9 +2288,10 @@ This means the target client will inherit these roles when requesting tokens.
|
|
|
2915
2288
|
|
|
2916
2289
|
|
|
2917
2290
|
```js
|
|
2291
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2918
2292
|
|
|
2919
2293
|
// map available roles
|
|
2920
|
-
await
|
|
2294
|
+
await KeycloakManager.clients.addClientScopeMappings({
|
|
2921
2295
|
id: 'internal-client-id', // Target client
|
|
2922
2296
|
client: "my-source-client-id", // Source client
|
|
2923
2297
|
},
|
|
@@ -2948,9 +2322,10 @@ It shows which roles from another client (source) are already mapped to the targ
|
|
|
2948
2322
|
|
|
2949
2323
|
|
|
2950
2324
|
```js
|
|
2325
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2951
2326
|
|
|
2952
2327
|
// list assigned role mappings
|
|
2953
|
-
const assignedRoles = await
|
|
2328
|
+
const assignedRoles = await KeycloakManager.clients.listClientScopeMappings({
|
|
2954
2329
|
id: 'internal-client-id', // Target client
|
|
2955
2330
|
client: "my-source-client", // Source client
|
|
2956
2331
|
});
|
|
@@ -2968,9 +2343,10 @@ It differs from listClientScopeMappings because it expands composite roles and s
|
|
|
2968
2343
|
- client: [required] The ID of the source client (the one that owns the roles)
|
|
2969
2344
|
|
|
2970
2345
|
```js
|
|
2346
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2971
2347
|
|
|
2972
2348
|
// list effective (composite) role mappings
|
|
2973
|
-
const effectiveRoles = await
|
|
2349
|
+
const effectiveRoles = await KeycloakManager.clients.listCompositeClientScopeMappings({
|
|
2974
2350
|
id: 'internal-client-id', // Target client
|
|
2975
2351
|
client: "my-source-client", // Source client
|
|
2976
2352
|
});
|
|
@@ -2994,9 +2370,10 @@ It is the reverse of clients.addClientScopeMappings
|
|
|
2994
2370
|
|
|
2995
2371
|
|
|
2996
2372
|
```js
|
|
2373
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
2997
2374
|
|
|
2998
2375
|
// Rremove roles from client mappings
|
|
2999
|
-
await
|
|
2376
|
+
await KeycloakManager.clients.delClientScopeMappings({
|
|
3000
2377
|
id: 'internal-client-id', // Target client
|
|
3001
2378
|
client: "my-source-client", // Source client
|
|
3002
2379
|
roles: [
|
|
@@ -3019,9 +2396,10 @@ These are roles defined at the realm level that the client does not yet have map
|
|
|
3019
2396
|
- id: [required] The ID of the client for which you want to list available realm-level role mappings.
|
|
3020
2397
|
|
|
3021
2398
|
```js
|
|
2399
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3022
2400
|
|
|
3023
2401
|
// Get available realm roles for client
|
|
3024
|
-
const availableRealmRoles = await
|
|
2402
|
+
const availableRealmRoles = await KeycloakManager.clients.listAvailableRealmScopeMappings({
|
|
3025
2403
|
id: 'internal-client-id',
|
|
3026
2404
|
});
|
|
3027
2405
|
|
|
@@ -3037,9 +2415,10 @@ These are roles defined at the realm level that the client does not yet have map
|
|
|
3037
2415
|
- id: [required] The ID of the client for which you want to list available realm-level role mappings.
|
|
3038
2416
|
|
|
3039
2417
|
```js
|
|
2418
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3040
2419
|
|
|
3041
2420
|
// Get available realm roles for client
|
|
3042
|
-
const availableRealmRoles = await
|
|
2421
|
+
const availableRealmRoles = await KeycloakManager.clients.listAvailableRealmScopeMappings({
|
|
3043
2422
|
id: 'internal-client-id',
|
|
3044
2423
|
});
|
|
3045
2424
|
|
|
@@ -3056,9 +2435,10 @@ This shows which realm roles the client is allowed to request on behalf of users
|
|
|
3056
2435
|
- id: [required] The client ID whose realm-level scope mappings you want to list
|
|
3057
2436
|
|
|
3058
2437
|
```js
|
|
2438
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3059
2439
|
|
|
3060
2440
|
// Get mapped realm roles for client
|
|
3061
|
-
const roles = await
|
|
2441
|
+
const roles = await KeycloakManager.clients.listRealmScopeMappings({
|
|
3062
2442
|
id: 'internal-client-id',
|
|
3063
2443
|
});
|
|
3064
2444
|
|
|
@@ -3074,9 +2454,10 @@ This includes not only the roles directly mapped to the client, but also roles i
|
|
|
3074
2454
|
- id: [required] The client ID whose composite realm scope mappings you want to list
|
|
3075
2455
|
|
|
3076
2456
|
```js
|
|
2457
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3077
2458
|
|
|
3078
2459
|
// Get mapped realm composite roles for client
|
|
3079
|
-
const roles = await
|
|
2460
|
+
const roles = await KeycloakManager.clients.listCompositeRealmScopeMappings({
|
|
3080
2461
|
id: 'internal-client-id',
|
|
3081
2462
|
});
|
|
3082
2463
|
|
|
@@ -3094,9 +2475,10 @@ This effectively grants the client access to the specified realm roles.
|
|
|
3094
2475
|
- roles: [required] An array of realm roles to be mapped to the client. Each role object typically contains at least id and name
|
|
3095
2476
|
|
|
3096
2477
|
```js
|
|
2478
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3097
2479
|
|
|
3098
2480
|
// Add Realm scope mappings
|
|
3099
|
-
await
|
|
2481
|
+
await KeycloakManager.clients.addRealmScopeMappings(
|
|
3100
2482
|
{id:'internal-client-id'},
|
|
3101
2483
|
[{id:'role1_id'},{id:'role1_id'}]
|
|
3102
2484
|
);
|
|
@@ -3112,9 +2494,10 @@ This is the opposite of clients.addRealmScopeMappings.
|
|
|
3112
2494
|
- roles: [required] An array of role objects you want to remove. Each role object must at least contain the id or name field.
|
|
3113
2495
|
|
|
3114
2496
|
```js
|
|
2497
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3115
2498
|
|
|
3116
2499
|
// remove Realm scope mappings
|
|
3117
|
-
await
|
|
2500
|
+
await KeycloakManager.clients.delRealmScopeMappings(
|
|
3118
2501
|
{id:'internal-client-id'},
|
|
3119
2502
|
[{id:'role1_id'},{id:'role1_id'}]
|
|
3120
2503
|
);
|
|
@@ -3130,9 +2513,10 @@ The method retrieves active user sessions for a specific client.
|
|
|
3130
2513
|
- max: [optional] pagination field. Maximum number of results.
|
|
3131
2514
|
|
|
3132
2515
|
```js
|
|
2516
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3133
2517
|
|
|
3134
2518
|
// get client sessions
|
|
3135
|
-
const sessions = await
|
|
2519
|
+
const sessions = await KeycloakManager.clients.listSessions({
|
|
3136
2520
|
id: 'internal-client-id',
|
|
3137
2521
|
first: 0,
|
|
3138
2522
|
max: 20,
|
|
@@ -3156,9 +2540,10 @@ Offline sessions are created when a client uses offline tokens (refresh tokens w
|
|
|
3156
2540
|
- max: [optional] pagination field. Maximum number of results.
|
|
3157
2541
|
|
|
3158
2542
|
```js
|
|
2543
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3159
2544
|
|
|
3160
2545
|
// get offline sessions
|
|
3161
|
-
const sessions = await
|
|
2546
|
+
const sessions = await KeycloakManager.clients.listOfflineSessions({
|
|
3162
2547
|
id: 'internal-client-id',
|
|
3163
2548
|
first: 0,
|
|
3164
2549
|
max: 20,
|
|
@@ -3179,9 +2564,10 @@ This includes online sessions, not offline sessions (those are retrieved with li
|
|
|
3179
2564
|
- id: [required] The client ID whose session must be retrieved
|
|
3180
2565
|
|
|
3181
2566
|
```js
|
|
2567
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3182
2568
|
|
|
3183
2569
|
// count active sessions
|
|
3184
|
-
const sessionCount = await
|
|
2570
|
+
const sessionCount = await KeycloakManager.clients.getSessionCount({
|
|
3185
2571
|
id: 'internal-client-id'
|
|
3186
2572
|
});
|
|
3187
2573
|
|
|
@@ -3198,9 +2584,10 @@ without requiring active login.
|
|
|
3198
2584
|
- id: [required] The ID of the client for which you want to count offline sessions.
|
|
3199
2585
|
|
|
3200
2586
|
```js
|
|
2587
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3201
2588
|
|
|
3202
2589
|
// count active sessions
|
|
3203
|
-
const sessionCount = await
|
|
2590
|
+
const sessionCount = await KeycloakManager.clients.getOfflineSessionCount({
|
|
3204
2591
|
id: 'internal-client-id'
|
|
3205
2592
|
});
|
|
3206
2593
|
|
|
@@ -3217,9 +2604,10 @@ client sessions and node information across multiple instances.
|
|
|
3217
2604
|
- id: [required] The ID of the client for which you want to add a cluster node.
|
|
3218
2605
|
- node: [required] The name or identifier of the cluster node to register.
|
|
3219
2606
|
```js
|
|
2607
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3220
2608
|
|
|
3221
2609
|
// Add Cluster Node
|
|
3222
|
-
await
|
|
2610
|
+
await KeycloakManager.clients.addClusterNode({
|
|
3223
2611
|
id: 'internal-client-id',
|
|
3224
2612
|
node:'127.0.0.1'
|
|
3225
2613
|
});
|
|
@@ -3237,9 +2625,10 @@ client session synchronization.
|
|
|
3237
2625
|
- id: [required] The ID of the client for which you want to remove a cluster node.
|
|
3238
2626
|
- node: [required] The name or identifier of the cluster node to remove.
|
|
3239
2627
|
```js
|
|
2628
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3240
2629
|
|
|
3241
2630
|
// Add Cluster Node
|
|
3242
|
-
await
|
|
2631
|
+
await KeycloakManager.clients.deleteClusterNode({
|
|
3243
2632
|
id: 'internal-client-id',
|
|
3244
2633
|
node:'127.0.0.1'
|
|
3245
2634
|
});
|
|
@@ -3263,6 +2652,7 @@ This is typically used for clients that require client credentials, JWT signing,
|
|
|
3263
2652
|
- realmCertificate: [optional] Indicates whether the realm certificate should be added to the keystore. Set to true to include it
|
|
3264
2653
|
|
|
3265
2654
|
```js
|
|
2655
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3266
2656
|
|
|
3267
2657
|
// set Configuration
|
|
3268
2658
|
const keystoreConfig = {
|
|
@@ -3276,7 +2666,7 @@ const keystoreConfig = {
|
|
|
3276
2666
|
const attr = "jwt.credential";
|
|
3277
2667
|
|
|
3278
2668
|
// Generate and download Key
|
|
3279
|
-
const result = await
|
|
2669
|
+
const result = await KeycloakManager.clients.generateAndDownloadKey(
|
|
3280
2670
|
{ id: internal-client-id, attr },
|
|
3281
2671
|
keystoreConfig,
|
|
3282
2672
|
);
|
|
@@ -3299,11 +2689,12 @@ Unlike clients.generateAndDownloadKey, this method only generates the key and st
|
|
|
3299
2689
|
- attr: [required] The name of the client attribute where the generated key will be saved
|
|
3300
2690
|
|
|
3301
2691
|
```js
|
|
2692
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3302
2693
|
|
|
3303
2694
|
const attr = "jwt.credential";
|
|
3304
2695
|
|
|
3305
2696
|
// Generate a Key
|
|
3306
|
-
const result = await
|
|
2697
|
+
const result = await KeycloakManager.clients.generateKey(
|
|
3307
2698
|
{ id: internal-client-id, attr }
|
|
3308
2699
|
);
|
|
3309
2700
|
|
|
@@ -3323,11 +2714,12 @@ It does not return the actual key material but provides information such as the
|
|
|
3323
2714
|
- attr: [optional] The name of the client attribute to get
|
|
3324
2715
|
|
|
3325
2716
|
```js
|
|
2717
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3326
2718
|
|
|
3327
2719
|
const attr = "jwt.credential";
|
|
3328
2720
|
|
|
3329
2721
|
// Get Key Info
|
|
3330
|
-
const keyInfo = await
|
|
2722
|
+
const keyInfo = await KeycloakManager.clients.getKeyInfo(
|
|
3331
2723
|
{ id: internal-client-id, attr }
|
|
3332
2724
|
);
|
|
3333
2725
|
|
|
@@ -3358,6 +2750,7 @@ This is typically used when you need to retrieve the public certificate of a cli
|
|
|
3358
2750
|
|
|
3359
2751
|
|
|
3360
2752
|
```js
|
|
2753
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3361
2754
|
|
|
3362
2755
|
// set Configuration
|
|
3363
2756
|
const keystoreConfig = {
|
|
@@ -3372,7 +2765,7 @@ const keystoreConfig = {
|
|
|
3372
2765
|
const attr = "jwt.credential";
|
|
3373
2766
|
|
|
3374
2767
|
// Generate and Key
|
|
3375
|
-
const cert = await
|
|
2768
|
+
const cert = await KeycloakManager.clients.downloadKey(
|
|
3376
2769
|
{ id: internal-client-id, attr },
|
|
3377
2770
|
keystoreConfig
|
|
3378
2771
|
);
|
|
@@ -3400,9 +2793,10 @@ that can later be linked to resources and policies.
|
|
|
3400
2793
|
- ... other scope representation fields
|
|
3401
2794
|
|
|
3402
2795
|
```js
|
|
2796
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3403
2797
|
|
|
3404
2798
|
// createAuthorizationScope
|
|
3405
|
-
await
|
|
2799
|
+
await KeycloakManager.clients.createAuthorizationScope(
|
|
3406
2800
|
{ id: 'internal-client-id' },
|
|
3407
2801
|
{
|
|
3408
2802
|
name: "manage-orders",
|
|
@@ -3422,9 +2816,10 @@ This includes both default scopes and optional scopes that can be assigned to th
|
|
|
3422
2816
|
|
|
3423
2817
|
|
|
3424
2818
|
```js
|
|
2819
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3425
2820
|
|
|
3426
2821
|
// Get scopes
|
|
3427
|
-
const scopes= await
|
|
2822
|
+
const scopes= await KeycloakManager.clients.listAllScopes({
|
|
3428
2823
|
id: 'internal-client-id'
|
|
3429
2824
|
});
|
|
3430
2825
|
|
|
@@ -3446,9 +2841,10 @@ Authorization scopes define permissions that can be used in policies and permiss
|
|
|
3446
2841
|
- .. other attributes: Additional attributes for the scope.
|
|
3447
2842
|
|
|
3448
2843
|
```js
|
|
2844
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3449
2845
|
|
|
3450
2846
|
// Update the scope-id authorization scope
|
|
3451
|
-
const scopes= await
|
|
2847
|
+
const scopes= await KeycloakManager.clients.updateAuthorizationScope(
|
|
3452
2848
|
{
|
|
3453
2849
|
id: 'internal-client-id',
|
|
3454
2850
|
scopeId: 'scope-id'
|
|
@@ -3474,9 +2870,10 @@ Authorization scopes define permissions that can be applied to resources and pol
|
|
|
3474
2870
|
- scopeId [required] The ID of the authorization scope to retrieve
|
|
3475
2871
|
|
|
3476
2872
|
```js
|
|
2873
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3477
2874
|
|
|
3478
2875
|
// get scope-id authorization scope
|
|
3479
|
-
const scope= await
|
|
2876
|
+
const scope= await KeycloakManager.clients.getAuthorizationScope({
|
|
3480
2877
|
id: 'internal-client-id',
|
|
3481
2878
|
scopeId: 'scope-id'
|
|
3482
2879
|
});
|
|
@@ -3494,9 +2891,10 @@ This allows you to see which resources are governed by a particular scope in the
|
|
|
3494
2891
|
- scopeId [required] The ID of the authorization scope whose associated resources you want to list.
|
|
3495
2892
|
|
|
3496
2893
|
```js
|
|
2894
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3497
2895
|
|
|
3498
2896
|
// List all resources by scope
|
|
3499
|
-
const resources= await
|
|
2897
|
+
const resources= await KeycloakManager.clients.listAllResourcesByScope({
|
|
3500
2898
|
id: 'internal-client-id',
|
|
3501
2899
|
scopeId: 'scope-id'
|
|
3502
2900
|
});
|
|
@@ -3515,9 +2913,10 @@ This is helpful for understanding which permissions (policies and rules) are app
|
|
|
3515
2913
|
- scopeId [required] The ID of the authorization scope whose associated permissions you want to list
|
|
3516
2914
|
|
|
3517
2915
|
```js
|
|
2916
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3518
2917
|
|
|
3519
2918
|
// list all permissions by scope
|
|
3520
|
-
const permissions= await
|
|
2919
|
+
const permissions= await KeycloakManager.clients.listAllPermissionsByScope({
|
|
3521
2920
|
id: 'internal-client-id',
|
|
3522
2921
|
scopeId: 'scope-id'
|
|
3523
2922
|
});
|
|
@@ -3540,9 +2939,10 @@ in Keycloak’s Authorization Services (UMA 2.0) framework.
|
|
|
3540
2939
|
- name: [optional] The name of the permission whose scopes should be retrieved
|
|
3541
2940
|
|
|
3542
2941
|
```js
|
|
2942
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3543
2943
|
|
|
3544
2944
|
// List permission scope
|
|
3545
|
-
const permissionScopes= await
|
|
2945
|
+
const permissionScopes= await KeycloakManager.clients.listPermissionScope({
|
|
3546
2946
|
id: 'internal-client-id',
|
|
3547
2947
|
name: "scope",
|
|
3548
2948
|
});
|
|
@@ -3564,9 +2964,10 @@ resources that a client can protect with policies and permissions.
|
|
|
3564
2964
|
- resource [required] The resource representation object. This typically includes attributes like name, uris, type, scopes, and other Keycloak resource configuration options.
|
|
3565
2965
|
|
|
3566
2966
|
```js
|
|
2967
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3567
2968
|
|
|
3568
2969
|
// import resource
|
|
3569
|
-
await
|
|
2970
|
+
await KeycloakManager.clients.importResource(
|
|
3570
2971
|
{
|
|
3571
2972
|
id: 'internal-client-id'
|
|
3572
2973
|
},
|
|
@@ -3596,9 +2997,10 @@ and associated permissions, which can then be backed up, replicated, or modified
|
|
|
3596
2997
|
- resourceId: [optional] The ID of the resource you want to export
|
|
3597
2998
|
|
|
3598
2999
|
```js
|
|
3000
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3599
3001
|
|
|
3600
3002
|
// resource export
|
|
3601
|
-
const exportedResource = await
|
|
3003
|
+
const exportedResource = await KeycloakManager.clients.exportResource({
|
|
3602
3004
|
id: 'internal-client-id'
|
|
3603
3005
|
});
|
|
3604
3006
|
|
|
@@ -3622,6 +3024,7 @@ a document, or any application-specific asset. This allows you to manage fine-gr
|
|
|
3622
3024
|
- owner: [optional] Defines the owner of the resource.
|
|
3623
3025
|
|
|
3624
3026
|
```js
|
|
3027
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3625
3028
|
|
|
3626
3029
|
// define a resource
|
|
3627
3030
|
const newResource = {
|
|
@@ -3631,7 +3034,7 @@ const newResource = {
|
|
|
3631
3034
|
type: 'REST',
|
|
3632
3035
|
};
|
|
3633
3036
|
// create resource
|
|
3634
|
-
const createdResource = await
|
|
3037
|
+
const createdResource = await KeycloakManager.clients.createResource(
|
|
3635
3038
|
{id: 'internal-client-id'},
|
|
3636
3039
|
newResource
|
|
3637
3040
|
);
|
|
@@ -3649,9 +3052,10 @@ that can have associated scopes, policies, and permissions for fine-grained acce
|
|
|
3649
3052
|
- id: [required] The ID of the client that owns the resource
|
|
3650
3053
|
- resourceId: [required] The ID of the resource you want to retrieve.
|
|
3651
3054
|
```js
|
|
3055
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3652
3056
|
|
|
3653
3057
|
// get resource
|
|
3654
|
-
const createdResource = await
|
|
3058
|
+
const createdResource = await KeycloakManager.clients.getResource({
|
|
3655
3059
|
id: 'internal-client-id',
|
|
3656
3060
|
resourceId: '12345-abcde',
|
|
3657
3061
|
});
|
|
@@ -3669,9 +3073,10 @@ meaning it can define resources, scopes, permissions, and policies for fine-grai
|
|
|
3669
3073
|
- id: [required] The ID of the client whose resource server configuration you want to retrieve
|
|
3670
3074
|
|
|
3671
3075
|
```js
|
|
3076
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3672
3077
|
|
|
3673
3078
|
// get resource Server
|
|
3674
|
-
const resourceServer = await
|
|
3079
|
+
const resourceServer = await KeycloakManager.clients.getResourceServer({
|
|
3675
3080
|
id: 'internal-client-id'
|
|
3676
3081
|
});
|
|
3677
3082
|
|
|
@@ -3692,6 +3097,7 @@ and policies that control fine-grained access to protected assets.
|
|
|
3692
3097
|
- Other resource server settings depending on your authorization model (resources, scopes, and permissions)
|
|
3693
3098
|
|
|
3694
3099
|
```js
|
|
3100
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3695
3101
|
|
|
3696
3102
|
//define resource Server
|
|
3697
3103
|
const resourceServerRepresentation={
|
|
@@ -3700,7 +3106,7 @@ const resourceServerRepresentation={
|
|
|
3700
3106
|
}
|
|
3701
3107
|
|
|
3702
3108
|
// update resource Server
|
|
3703
|
-
await
|
|
3109
|
+
await KeycloakManager.clients.updateResourceServer(
|
|
3704
3110
|
{ id: 'internal-client-id' },
|
|
3705
3111
|
resourceServerRepresentation
|
|
3706
3112
|
);
|
|
@@ -3718,10 +3124,11 @@ This is part of the Keycloak Authorization Services API and helps administrators
|
|
|
3718
3124
|
- resourceId: [required] The ID of the resource for which to list permissions.
|
|
3719
3125
|
|
|
3720
3126
|
```js
|
|
3127
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3721
3128
|
|
|
3722
3129
|
|
|
3723
3130
|
// List permissions by resource
|
|
3724
|
-
const permissions= await
|
|
3131
|
+
const permissions= await KeycloakManager.clients.listPermissionsByResource({
|
|
3725
3132
|
id: 'internal-client-id',
|
|
3726
3133
|
resourceId: 'resource-id'
|
|
3727
3134
|
});
|
|
@@ -3745,9 +3152,10 @@ based on policies you configure. This is part of Keycloak’s Authorization Serv
|
|
|
3745
3152
|
- policies [required] Array of policy IDs associated with this permission
|
|
3746
3153
|
|
|
3747
3154
|
```js
|
|
3155
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3748
3156
|
|
|
3749
3157
|
// create a permission
|
|
3750
|
-
await
|
|
3158
|
+
await KeycloakManager.clients.createPermission({
|
|
3751
3159
|
id: 'internal-client-id',
|
|
3752
3160
|
type: "scope",
|
|
3753
3161
|
},
|
|
@@ -3780,9 +3188,10 @@ and this method allows you to list and filter them based on specific criteria.
|
|
|
3780
3188
|
- first: [optional] Index of the first result for pagination
|
|
3781
3189
|
- max: [optional] Maximum number of results to return
|
|
3782
3190
|
```js
|
|
3191
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3783
3192
|
|
|
3784
3193
|
// search permission
|
|
3785
|
-
const permissions= await
|
|
3194
|
+
const permissions= await KeycloakManager.clients.findPermissions({
|
|
3786
3195
|
id: 'internal-client-id',
|
|
3787
3196
|
name: "View Orders",
|
|
3788
3197
|
type: "resource",
|
|
@@ -3803,9 +3212,10 @@ Fine-grained permissions allow you to control which users/roles can manage diffe
|
|
|
3803
3212
|
- status: JSON structure that defines the fine grain permission
|
|
3804
3213
|
- enabled: [required] Whether fine-grained permissions should be enabled or disabled.
|
|
3805
3214
|
```js
|
|
3215
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3806
3216
|
|
|
3807
3217
|
// enable fine-grained permissions for this client
|
|
3808
|
-
await
|
|
3218
|
+
await KeycloakManager.clients.updateFineGrainPermission(
|
|
3809
3219
|
{ id: 'internal-client-id'},
|
|
3810
3220
|
{ enabled: true }
|
|
3811
3221
|
);
|
|
@@ -3820,9 +3230,10 @@ This is useful for checking which permissions are configured (e.g., managing rol
|
|
|
3820
3230
|
- filter: JSON structure that defines the filter parameters:
|
|
3821
3231
|
- id: [required] The ID of the client (the resource server) where permissions are defined
|
|
3822
3232
|
```js
|
|
3233
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3823
3234
|
|
|
3824
3235
|
// enable fine-grained permissions for this client
|
|
3825
|
-
const permissions= await
|
|
3236
|
+
const permissions= await KeycloakManager.clients.listFineGrainPermissions(
|
|
3826
3237
|
{ id: 'internal-client-id'},
|
|
3827
3238
|
{ enabled: true }
|
|
3828
3239
|
);
|
|
@@ -3840,9 +3251,10 @@ In Keycloak’s Authorization Services, permissions can be linked to one or more
|
|
|
3840
3251
|
- permissionId: [required] The ID of the permission whose associated scopes you want to retrieve.
|
|
3841
3252
|
|
|
3842
3253
|
```js
|
|
3254
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3843
3255
|
|
|
3844
3256
|
// List associated scope
|
|
3845
|
-
const scopes= await
|
|
3257
|
+
const scopes= await KeycloakManager.clients.getAssociatedScopes({
|
|
3846
3258
|
id: 'internal-client-id',
|
|
3847
3259
|
permissionId: "123e4567-e89b-12d3-a456-426614174000",
|
|
3848
3260
|
});
|
|
@@ -3859,9 +3271,10 @@ n Keycloak Authorization Services, permissions can be tied to one or more polici
|
|
|
3859
3271
|
- permissionId: [required] The ID of the permission whose associated policies you want to retrieve.
|
|
3860
3272
|
|
|
3861
3273
|
```js
|
|
3274
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3862
3275
|
|
|
3863
3276
|
// List associated policies
|
|
3864
|
-
const policies= await
|
|
3277
|
+
const policies= await KeycloakManager.clients.getAssociatedPolicies({
|
|
3865
3278
|
id: 'internal-client-id',
|
|
3866
3279
|
permissionId: "123e4567-e89b-12d3-a456-426614174000",
|
|
3867
3280
|
});
|
|
@@ -3880,9 +3293,10 @@ In Keycloak Authorization Services, permissions can be scoped to one or more res
|
|
|
3880
3293
|
- permissionId: [required] The ID of the permission for which you want to fetch associated resources.
|
|
3881
3294
|
|
|
3882
3295
|
```js
|
|
3296
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3883
3297
|
|
|
3884
3298
|
// List associated resources
|
|
3885
|
-
const resources= await
|
|
3299
|
+
const resources= await KeycloakManager.clients.getAssociatedResources({
|
|
3886
3300
|
id: 'internal-client-id',
|
|
3887
3301
|
permissionId: "123e4567-e89b-12d3-a456-426614174000",
|
|
3888
3302
|
});
|
|
@@ -3901,10 +3315,11 @@ This allows administrators to understand which scopes are directly linked to a p
|
|
|
3901
3315
|
- resourceId: [required] The ID of the resource for which to list scopes.
|
|
3902
3316
|
|
|
3903
3317
|
```js
|
|
3318
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3904
3319
|
|
|
3905
3320
|
|
|
3906
3321
|
// List permissions by resource
|
|
3907
|
-
const scopes= await
|
|
3322
|
+
const scopes= await KeycloakManager.clients.listScopesByResource({
|
|
3908
3323
|
id: 'internal-client-id',
|
|
3909
3324
|
resourceId: 'resource-id'
|
|
3910
3325
|
});
|
|
@@ -3928,10 +3343,11 @@ Resources represent protected entities (such as APIs, files, or services) that c
|
|
|
3928
3343
|
- owner: [optional] Filters resources by owner
|
|
3929
3344
|
|
|
3930
3345
|
```js
|
|
3346
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3931
3347
|
|
|
3932
3348
|
|
|
3933
3349
|
// List resources
|
|
3934
|
-
const resources= await
|
|
3350
|
+
const resources= await KeycloakManager.clients.listResources({
|
|
3935
3351
|
id: 'internal-client-id'
|
|
3936
3352
|
});
|
|
3937
3353
|
|
|
@@ -3957,10 +3373,11 @@ Resources represent protected entities (APIs, files, services, etc.) that can be
|
|
|
3957
3373
|
|
|
3958
3374
|
|
|
3959
3375
|
```js
|
|
3376
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
3960
3377
|
|
|
3961
3378
|
|
|
3962
3379
|
// Update resource
|
|
3963
|
-
await
|
|
3380
|
+
await KeycloakManager.clients.updateResource(
|
|
3964
3381
|
{
|
|
3965
3382
|
id: 'internal-client-id',
|
|
3966
3383
|
resourceId: 'resource-id'
|
|
@@ -4001,10 +3418,11 @@ They can be based on users, roles, groups, conditions, or custom logic.
|
|
|
4001
3418
|
|
|
4002
3419
|
|
|
4003
3420
|
```js
|
|
3421
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4004
3422
|
|
|
4005
3423
|
|
|
4006
3424
|
// create new policy
|
|
4007
|
-
await
|
|
3425
|
+
await KeycloakManager.clients.createPolicy(
|
|
4008
3426
|
{
|
|
4009
3427
|
id: 'internal-client-id',
|
|
4010
3428
|
type: "role",
|
|
@@ -4037,10 +3455,11 @@ This is useful when you want to understand how a policy is referenced by other p
|
|
|
4037
3455
|
- policyId: [required] The ID of the policy for which you want to list dependent policies.
|
|
4038
3456
|
|
|
4039
3457
|
```js
|
|
3458
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4040
3459
|
|
|
4041
3460
|
|
|
4042
3461
|
// create new policy
|
|
4043
|
-
const dependentPolicies= await
|
|
3462
|
+
const dependentPolicies= await KeycloakManager.clients.listDependentPolicies(
|
|
4044
3463
|
{
|
|
4045
3464
|
id: 'internal-client-id',
|
|
4046
3465
|
policyId: "1234-abcd-policy-id",
|
|
@@ -4061,8 +3480,9 @@ contents without performing a full user login. This can help you verify client r
|
|
|
4061
3480
|
- id: [required] ID of the client for which you want to generate or evaluate the access token
|
|
4062
3481
|
|
|
4063
3482
|
```js
|
|
3483
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4064
3484
|
// generate accesstoken
|
|
4065
|
-
const token = await
|
|
3485
|
+
const token = await KeycloakManager.clients.evaluateGenerateAccessToken({
|
|
4066
3486
|
id: 'internal-client-id'
|
|
4067
3487
|
});
|
|
4068
3488
|
|
|
@@ -4087,8 +3507,9 @@ token for the client.
|
|
|
4087
3507
|
- id: [required] ID of the client for which you want to generate or evaluate the ID token
|
|
4088
3508
|
|
|
4089
3509
|
```js
|
|
3510
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4090
3511
|
// generate id token
|
|
4091
|
-
const token = await
|
|
3512
|
+
const token = await KeycloakManager.clients.evaluateGenerateIdToken({
|
|
4092
3513
|
id: 'internal-client-id',
|
|
4093
3514
|
});
|
|
4094
3515
|
|
|
@@ -4112,8 +3533,9 @@ UserInfo response without performing a full login flow.
|
|
|
4112
3533
|
- id: [required] The ID of the client for which you want to generate the UserInfo response
|
|
4113
3534
|
|
|
4114
3535
|
```js
|
|
3536
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4115
3537
|
// generate toke user info
|
|
4116
|
-
const userInfo = await
|
|
3538
|
+
const userInfo = await KeycloakManager.clients.evaluateGenerateUserInfo({
|
|
4117
3539
|
id: 'internal-client-id',
|
|
4118
3540
|
});
|
|
4119
3541
|
|
|
@@ -4142,8 +3564,9 @@ Protocol mappers define how user information (claims) is mapped into tokens (lik
|
|
|
4142
3564
|
- id: [required] ID of the client for which you want to list or evaluate protocol mappers.
|
|
4143
3565
|
|
|
4144
3566
|
```js
|
|
3567
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4145
3568
|
// List protocol mappers for client
|
|
4146
|
-
const protocolMappers = await
|
|
3569
|
+
const protocolMappers = await KeycloakManager.clients.evaluateListProtocolMapper({
|
|
4147
3570
|
id: 'internal-client-id',
|
|
4148
3571
|
});
|
|
4149
3572
|
|
|
@@ -4176,8 +3599,9 @@ Protocol mappers define how data from user/client models is added to tokens (e.g
|
|
|
4176
3599
|
- ....
|
|
4177
3600
|
|
|
4178
3601
|
```js
|
|
3602
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4179
3603
|
// add single protocol mapper
|
|
4180
|
-
await
|
|
3604
|
+
await KeycloakManager.clients.addProtocolMapper(
|
|
4181
3605
|
{id: 'internal-client-id'},
|
|
4182
3606
|
{
|
|
4183
3607
|
name: "become-a-farmer",
|
|
@@ -4219,8 +3643,9 @@ The method is used to update an existing protocol mapper for a specific client i
|
|
|
4219
3643
|
- ....
|
|
4220
3644
|
|
|
4221
3645
|
```js
|
|
3646
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4222
3647
|
// update protocol mappe
|
|
4223
|
-
await
|
|
3648
|
+
await KeycloakManager.clients.updateProtocolMapper(
|
|
4224
3649
|
{id: 'internal-client-id', mapperId:'mapper-id'},
|
|
4225
3650
|
{
|
|
4226
3651
|
name: "become-a-farmer",
|
|
@@ -4259,8 +3684,9 @@ This batch operation is efficient when you want to configure multiple mappings w
|
|
|
4259
3684
|
- ....
|
|
4260
3685
|
|
|
4261
3686
|
```js
|
|
3687
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4262
3688
|
// add multiple protocol mappers
|
|
4263
|
-
await
|
|
3689
|
+
await KeycloakManager.clients.addMultipleProtocolMappers(
|
|
4264
3690
|
{id: 'internal-client-id'},
|
|
4265
3691
|
[
|
|
4266
3692
|
{
|
|
@@ -4311,8 +3737,9 @@ It is particularly useful when you want to verify if a mapper exists or fetch it
|
|
|
4311
3737
|
- name: [required] The name of the protocol mapper to look up. (usually "openid-connect" or "saml").
|
|
4312
3738
|
|
|
4313
3739
|
```js
|
|
3740
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4314
3741
|
// find Protocol Mapper ByName
|
|
4315
|
-
await
|
|
3742
|
+
await KeycloakManager.clients.findProtocolMapperByName({
|
|
4316
3743
|
id: 'internal-client-id',
|
|
4317
3744
|
name: 'protocol-name',
|
|
4318
3745
|
});
|
|
@@ -4330,8 +3757,9 @@ The method returns all protocol mappers associated with a client, filtered by a
|
|
|
4330
3757
|
- "saml"
|
|
4331
3758
|
|
|
4332
3759
|
```js
|
|
3760
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4333
3761
|
// find protocol mappers by protocol
|
|
4334
|
-
const mappers = await
|
|
3762
|
+
const mappers = await KeycloakManager.clients.findProtocolMappersByProtocol({
|
|
4335
3763
|
id: 'internal-client-id',
|
|
4336
3764
|
protocol: 'openid-connect',
|
|
4337
3765
|
});
|
|
@@ -4350,8 +3778,9 @@ The method retrieves the details of a specific protocol mapper by its ID for a g
|
|
|
4350
3778
|
- mapperId: [required] The ID of the protocol mapper you want to fetch.
|
|
4351
3779
|
|
|
4352
3780
|
```js
|
|
3781
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4353
3782
|
// find Protocol Mapper By Id
|
|
4354
|
-
const mapper = await
|
|
3783
|
+
const mapper = await KeycloakManager.clients.findProtocolMapperById({
|
|
4355
3784
|
id: 'internal-client-id',
|
|
4356
3785
|
mapperId: 'protocol-id',
|
|
4357
3786
|
});
|
|
@@ -4369,8 +3798,9 @@ This method is useful for inspecting or managing the token contents of a client.
|
|
|
4369
3798
|
- id: [required] The internal ID of the client whose protocol mappers you want to list.
|
|
4370
3799
|
|
|
4371
3800
|
```js
|
|
3801
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4372
3802
|
// list protocol mappers
|
|
4373
|
-
const protocolMappers = await
|
|
3803
|
+
const protocolMappers = await KeycloakManager.clients.listProtocolMappers({
|
|
4374
3804
|
id: 'internal-client-id',
|
|
4375
3805
|
});
|
|
4376
3806
|
console.log("Protocol Mappers:", protocolMappers);
|
|
@@ -4388,8 +3818,9 @@ This method is useful when you want to remove an existing mapper from a client c
|
|
|
4388
3818
|
- mapperId: [required] The ID of the protocol mapper to delete
|
|
4389
3819
|
|
|
4390
3820
|
```js
|
|
3821
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4391
3822
|
// Del Protocol Mapper
|
|
4392
|
-
await
|
|
3823
|
+
await KeycloakManager.clients.delProtocolMapper({
|
|
4393
3824
|
id: 'internal-client-id',
|
|
4394
3825
|
mapperId: 'mapper-id',
|
|
4395
3826
|
});
|
|
@@ -4409,8 +3840,9 @@ method is used to create a new client scope in a Keycloak realm.
|
|
|
4409
3840
|
A client scope defines a set of protocol mappers and roles that can be applied to clients,
|
|
4410
3841
|
such as during login or token generation.
|
|
4411
3842
|
```js
|
|
3843
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4412
3844
|
// create a group called my-group
|
|
4413
|
-
await
|
|
3845
|
+
await KeycloakManager.clientScopes.create({
|
|
4414
3846
|
name: "scope-name",
|
|
4415
3847
|
description: "scope-description",
|
|
4416
3848
|
protocol: "openid-connect",
|
|
@@ -4432,8 +3864,9 @@ You can modify properties such as the scope’s name, description, attributes, o
|
|
|
4432
3864
|
- other scope fields....
|
|
4433
3865
|
|
|
4434
3866
|
```js
|
|
3867
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4435
3868
|
// update a scope called my-scope-id
|
|
4436
|
-
await
|
|
3869
|
+
await KeycloakManager.clientScopes.update(
|
|
4437
3870
|
{id:'my-scope-id'},
|
|
4438
3871
|
{
|
|
4439
3872
|
name: "scope-name",
|
|
@@ -4453,8 +3886,9 @@ Once deleted, the client scope will no longer be available for assignment to cli
|
|
|
4453
3886
|
- id: [required] The unique ID of the client scope to delete.
|
|
4454
3887
|
- realm: [optional] The realm where the client scope is defined.
|
|
4455
3888
|
```js
|
|
3889
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4456
3890
|
// delete client scope
|
|
4457
|
-
await
|
|
3891
|
+
await KeycloakManager.clientScopes.del({
|
|
4458
3892
|
id: "scope-id",
|
|
4459
3893
|
});
|
|
4460
3894
|
```
|
|
@@ -4468,8 +3902,9 @@ It's an alternative to deleting by ID when the scope's name is known.
|
|
|
4468
3902
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
4469
3903
|
- name: [required] The name of the client scope to delete. This must match exactly with the registered name in the realm.
|
|
4470
3904
|
```js
|
|
3905
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4471
3906
|
// cleanup client scopes
|
|
4472
|
-
await
|
|
3907
|
+
await KeycloakManager.clientScopes.delByName({
|
|
4473
3908
|
name: "scope-name",
|
|
4474
3909
|
});
|
|
4475
3910
|
```
|
|
@@ -4486,8 +3921,9 @@ Client scopes represent a set of protocol mappers and roles that can be assigned
|
|
|
4486
3921
|
- first: [optional] Index of the first result (for pagination).
|
|
4487
3922
|
- max: [optional] Maximum number of results to return.
|
|
4488
3923
|
```js
|
|
3924
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4489
3925
|
// Find client Scope
|
|
4490
|
-
const scope = await
|
|
3926
|
+
const scope = await KeycloakManager.clientScopes.find({
|
|
4491
3927
|
max: 10
|
|
4492
3928
|
});
|
|
4493
3929
|
console.log("Search Result:",scope);
|
|
@@ -4503,8 +3939,9 @@ It’s useful when you need the full configuration of a particular client scope,
|
|
|
4503
3939
|
- realm: [optional] The realm where the client scope is defined.
|
|
4504
3940
|
|
|
4505
3941
|
```js
|
|
3942
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4506
3943
|
// Find one client Scope
|
|
4507
|
-
const scope = await
|
|
3944
|
+
const scope = await KeycloakManager.clientScopes.findOne({
|
|
4508
3945
|
id: 'my-scope-id'
|
|
4509
3946
|
});
|
|
4510
3947
|
console.log("Search Result:",scope);
|
|
@@ -4519,8 +3956,9 @@ including its ID, protocol, and other settings.
|
|
|
4519
3956
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
4520
3957
|
- name: [required] The name of the client scope you're searching for.
|
|
4521
3958
|
```js
|
|
3959
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4522
3960
|
// Find client Scope by name
|
|
4523
|
-
const scope = await
|
|
3961
|
+
const scope = await KeycloakManager.clientScopes.findOneByName({
|
|
4524
3962
|
name: "scope-name",
|
|
4525
3963
|
});
|
|
4526
3964
|
console.log("Search Result:",scope);
|
|
@@ -4537,8 +3975,9 @@ Default client scopes are automatically assigned to newly created clients in tha
|
|
|
4537
3975
|
- first: [optional] Index of the first result (for pagination).
|
|
4538
3976
|
- max: [optional] Maximum number of results to return.
|
|
4539
3977
|
```js
|
|
3978
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4540
3979
|
// list default client scopes
|
|
4541
|
-
const scopes = await
|
|
3980
|
+
const scopes = await KeycloakManager.clientScopes.listDefaultClientScopes({
|
|
4542
3981
|
realm: "realm-name",
|
|
4543
3982
|
});
|
|
4544
3983
|
console.log("Search Result:",scopes);
|
|
@@ -4554,8 +3993,9 @@ Default client scopes are automatically assigned to all newly created clients wi
|
|
|
4554
3993
|
- id: [required] The ID of the client scope to add as a default.
|
|
4555
3994
|
- realm: [optional] The realm where the client scopes are defined.
|
|
4556
3995
|
```js
|
|
3996
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4557
3997
|
// add default client scope
|
|
4558
|
-
await
|
|
3998
|
+
await KeycloakManager.clientScopes.addDefaultClientScope({
|
|
4559
3999
|
id: "client-scope-id",
|
|
4560
4000
|
});
|
|
4561
4001
|
|
|
@@ -4573,8 +4013,9 @@ Removing one prevents it from being included by default.
|
|
|
4573
4013
|
- realm:: [optional] The realm where the client scope is defined.
|
|
4574
4014
|
|
|
4575
4015
|
```js
|
|
4016
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4576
4017
|
// delete default client Scope
|
|
4577
|
-
await
|
|
4018
|
+
await KeycloakManager.clientScopes.delDefaultClientScope({
|
|
4578
4019
|
realm: "myrealm-name",
|
|
4579
4020
|
id: "default-profile-scope-id",
|
|
4580
4021
|
});
|
|
@@ -4592,8 +4033,9 @@ Optional client scopes are available for clients to select but are not automatic
|
|
|
4592
4033
|
- realm:: [optional] The realm where the client scope is defined.
|
|
4593
4034
|
|
|
4594
4035
|
```js
|
|
4036
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4595
4037
|
// list default optional client scopes
|
|
4596
|
-
const optionalScopes= await
|
|
4038
|
+
const optionalScopes= await KeycloakManager.clientScopes.listDefaultOptionalClientScopes({
|
|
4597
4039
|
realm: "myrealm-name",
|
|
4598
4040
|
id: "default-profile-scope-id",
|
|
4599
4041
|
});
|
|
@@ -4612,8 +4054,9 @@ Optional client scopes are available to clients for selection but are not automa
|
|
|
4612
4054
|
- realm:: [optional] The realm where the client scope is defined.
|
|
4613
4055
|
|
|
4614
4056
|
```js
|
|
4057
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4615
4058
|
// add default optional client scope
|
|
4616
|
-
await
|
|
4059
|
+
await KeycloakManager.clientScopes.addDefaultOptionalClientScope({
|
|
4617
4060
|
realm: "myrealm-name",
|
|
4618
4061
|
id: "default-profile-scope-id",
|
|
4619
4062
|
});
|
|
@@ -4634,8 +4077,9 @@ Removing one prevents it from being listed as optional for new clients.
|
|
|
4634
4077
|
- realm:: [optional] The realm where the client scope is defined.
|
|
4635
4078
|
|
|
4636
4079
|
```js
|
|
4080
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4637
4081
|
// delete optional client Scope
|
|
4638
|
-
await
|
|
4082
|
+
await KeycloakManager.clientScopes.delDefaultOptionalClientScope({
|
|
4639
4083
|
realm: "myrealm-name",
|
|
4640
4084
|
id: "default-profile-scope-id",
|
|
4641
4085
|
});
|
|
@@ -4655,8 +4099,9 @@ Protocol mappers define how user attributes, roles, or other data are mapped int
|
|
|
4655
4099
|
- name: [optional] The name of the protocol mapper to find.
|
|
4656
4100
|
|
|
4657
4101
|
```js
|
|
4102
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4658
4103
|
// find protocol mapper by name
|
|
4659
|
-
const mapper= await
|
|
4104
|
+
const mapper= await KeycloakManager.clientScopes.findProtocolMapperByName({
|
|
4660
4105
|
realm: "myrealm-name",
|
|
4661
4106
|
id: "mapper-id-protocol",
|
|
4662
4107
|
name: "username",
|
|
@@ -4680,8 +4125,9 @@ Protocol mappers define how user attributes, roles, or other information are map
|
|
|
4680
4125
|
- realm: [optional] The realm where the client scope is defined.
|
|
4681
4126
|
|
|
4682
4127
|
```js
|
|
4128
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4683
4129
|
// find protocol mapper by name
|
|
4684
|
-
const mapper= await
|
|
4130
|
+
const mapper= await KeycloakManager.clientScopes.findProtocolMapper({
|
|
4685
4131
|
realm: "myrealm-name",
|
|
4686
4132
|
id: "client-scope-id",
|
|
4687
4133
|
mapperId: "mapper-id-123",
|
|
@@ -4705,8 +4151,9 @@ This is useful when you want to filter protocol mappers by the authentication pr
|
|
|
4705
4151
|
- realm: [optional] The realm where the client scope is defined.
|
|
4706
4152
|
|
|
4707
4153
|
```js
|
|
4154
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4708
4155
|
// find protocol mapper by protocol
|
|
4709
|
-
const mapper= await
|
|
4156
|
+
const mapper= await KeycloakManager.clientScopes.findProtocolMappersByProtocol({
|
|
4710
4157
|
realm: "myrealm-name",
|
|
4711
4158
|
id: "client-scope-id",
|
|
4712
4159
|
protocol: "openid-connect",
|
|
@@ -4731,9 +4178,10 @@ Deleting a mapper removes its configuration from the client scope.
|
|
|
4731
4178
|
- realm: [optional] The realm where the client scope is defined.
|
|
4732
4179
|
|
|
4733
4180
|
```js
|
|
4181
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4734
4182
|
|
|
4735
4183
|
// Del Protocol Mapper
|
|
4736
|
-
await
|
|
4184
|
+
await KeycloakManager.clientScopes.delProtocolMapper({
|
|
4737
4185
|
realm: "my-realm-id",
|
|
4738
4186
|
id: "client-id",
|
|
4739
4187
|
mapperId: "mapper-id-123",
|
|
@@ -4752,9 +4200,10 @@ Protocol mappers define how user attributes, roles, or other data are mapped int
|
|
|
4752
4200
|
- realm: [optional] The realm where the client scope is defined.
|
|
4753
4201
|
|
|
4754
4202
|
```js
|
|
4203
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4755
4204
|
|
|
4756
4205
|
// list protocol mapper
|
|
4757
|
-
const mappers= await
|
|
4206
|
+
const mappers= await KeycloakManager.clientScopes.listProtocolMappers({
|
|
4758
4207
|
realm: "myrealm-name",
|
|
4759
4208
|
id: "mapper-id",
|
|
4760
4209
|
});
|
|
@@ -4780,9 +4229,10 @@ With this method, you can configure several mappers in a single request.
|
|
|
4780
4229
|
- consentRequired: [optional] Whether user consent is required.
|
|
4781
4230
|
|
|
4782
4231
|
```js
|
|
4232
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4783
4233
|
|
|
4784
4234
|
// add multiple protocol mappers
|
|
4785
|
-
await
|
|
4235
|
+
await KeycloakManager.clientScopes.addMultipleProtocolMappers(
|
|
4786
4236
|
{ id: 'client-scope-id' },
|
|
4787
4237
|
[
|
|
4788
4238
|
{
|
|
@@ -4826,9 +4276,10 @@ Protocol mappers define how user attributes, roles, or other information are map
|
|
|
4826
4276
|
- consentRequired: [optional] Whether user consent is required.
|
|
4827
4277
|
|
|
4828
4278
|
```js
|
|
4279
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4829
4280
|
|
|
4830
4281
|
// add protocol mapper
|
|
4831
|
-
await
|
|
4282
|
+
await KeycloakManager.clientScopes.addProtocolMapper(
|
|
4832
4283
|
{ id: 'client-scope-id' },
|
|
4833
4284
|
|
|
4834
4285
|
{
|
|
@@ -4868,9 +4319,10 @@ With this method, you can modify an existing mapper’s configuration.
|
|
|
4868
4319
|
- consentRequired: [optional] Whether user consent is required.
|
|
4869
4320
|
|
|
4870
4321
|
```js
|
|
4322
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4871
4323
|
|
|
4872
4324
|
// add protocol mapper
|
|
4873
|
-
await
|
|
4325
|
+
await KeycloakManager.clientScopes.updateProtocolMapper(
|
|
4874
4326
|
{ id: 'client-scope-id' , mapperId: "mapper-id-123",},
|
|
4875
4327
|
|
|
4876
4328
|
{
|
|
@@ -4902,9 +4354,10 @@ These roles determine the permissions and access tokens issued for clients using
|
|
|
4902
4354
|
- realm: [optional] The realm where the client scope is defined.
|
|
4903
4355
|
|
|
4904
4356
|
```js
|
|
4357
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4905
4358
|
|
|
4906
4359
|
// list scope mapping
|
|
4907
|
-
const scopeMappings= await
|
|
4360
|
+
const scopeMappings= await KeycloakManager.clientScopes.listScopeMappings({
|
|
4908
4361
|
realm: "myrealm-name",
|
|
4909
4362
|
id: "client-scope-id",
|
|
4910
4363
|
});
|
|
@@ -4925,9 +4378,10 @@ This helps identify which roles from a specific client are still available to be
|
|
|
4925
4378
|
- realm: [optional] The realm where the client scope is defined.
|
|
4926
4379
|
|
|
4927
4380
|
```js
|
|
4381
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4928
4382
|
|
|
4929
4383
|
// list available client scope mapping
|
|
4930
|
-
const availableRoles= await
|
|
4384
|
+
const availableRoles= await KeycloakManager.clientScopes.listAvailableClientScopeMappings({
|
|
4931
4385
|
realm: "myrealm-name",
|
|
4932
4386
|
id: "client-scope-id",
|
|
4933
4387
|
client:'client-id'
|
|
@@ -4956,9 +4410,10 @@ This means the client scope will include the selected roles, and any client usin
|
|
|
4956
4410
|
- containerId: [optional] The ID of the client containing the role.
|
|
4957
4411
|
|
|
4958
4412
|
```js
|
|
4413
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
4959
4414
|
|
|
4960
4415
|
// add client scope mapping
|
|
4961
|
-
const availableRoles= await
|
|
4416
|
+
const availableRoles= await KeycloakManager.clientScopes.addClientScopeMappings(
|
|
4962
4417
|
{
|
|
4963
4418
|
realm: "myrealm-name",
|
|
4964
4419
|
id: "client-scope-id",
|
|
@@ -5002,9 +4457,10 @@ This allows you to revoke previously assigned client roles so they are no longer
|
|
|
5002
4457
|
- containerId: [optional] The ID of the client containing the role.
|
|
5003
4458
|
|
|
5004
4459
|
```js
|
|
4460
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5005
4461
|
|
|
5006
4462
|
// add client scope mapping
|
|
5007
|
-
const availableRoles= await
|
|
4463
|
+
const availableRoles= await KeycloakManager.clientScopes.delClientScopeMappings(
|
|
5008
4464
|
{
|
|
5009
4465
|
realm: "myrealm-name",
|
|
5010
4466
|
id: "client-scope-id",
|
|
@@ -5042,9 +4498,10 @@ This allows you to check which roles from a particular client are already includ
|
|
|
5042
4498
|
- realm: [optional] The realm where the client scope is defined.
|
|
5043
4499
|
|
|
5044
4500
|
```js
|
|
4501
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5045
4502
|
|
|
5046
4503
|
// list client scope mapping
|
|
5047
|
-
const mappedRoles= await
|
|
4504
|
+
const mappedRoles= await KeycloakManager.clientScopes.listClientScopeMappings({
|
|
5048
4505
|
realm: "myrealm-name",
|
|
5049
4506
|
id: "client-scope-id",
|
|
5050
4507
|
client: "client-id",
|
|
@@ -5066,9 +4523,10 @@ This is useful when you want to see the final set of roles available in a client
|
|
|
5066
4523
|
- realm: [optional] The realm where the client scope is defined.
|
|
5067
4524
|
|
|
5068
4525
|
```js
|
|
4526
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5069
4527
|
|
|
5070
4528
|
// list client scope mapping
|
|
5071
|
-
const mappedRoles= await
|
|
4529
|
+
const mappedRoles= await KeycloakManager.clientScopes.listCompositeClientScopeMappings({
|
|
5072
4530
|
realm: "myrealm-name",
|
|
5073
4531
|
id: "client-scope-id",
|
|
5074
4532
|
client: "client-id",
|
|
@@ -5089,9 +4547,10 @@ This helps you determine which realm-level roles can still be added to the clien
|
|
|
5089
4547
|
- realm: [optional] The realm where the client scope is defined.
|
|
5090
4548
|
|
|
5091
4549
|
```js
|
|
4550
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5092
4551
|
|
|
5093
4552
|
// list available realm scope mappings
|
|
5094
|
-
const availableRealmRoles= await
|
|
4553
|
+
const availableRealmRoles= await KeycloakManager.clientScopes.listAvailableRealmScopeMappings({
|
|
5095
4554
|
realm: "myrealm-name",
|
|
5096
4555
|
id: "client-scope-id",
|
|
5097
4556
|
});
|
|
@@ -5117,9 +4576,10 @@ This means that any client using this client scope will inherit the specified re
|
|
|
5117
4576
|
- containerId: [optional] The ID of the realm containing the role.
|
|
5118
4577
|
|
|
5119
4578
|
```js
|
|
4579
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5120
4580
|
|
|
5121
4581
|
// add realm scope mappings
|
|
5122
|
-
const availableRealmRoles= await
|
|
4582
|
+
const availableRealmRoles= await KeycloakManager.clientScopes.addRealmScopeMappings(
|
|
5123
4583
|
{
|
|
5124
4584
|
realm: "myrealm-name",
|
|
5125
4585
|
id: "client-scope-idb"
|
|
@@ -5151,9 +4611,10 @@ This revokes previously assigned realm roles, so clients using this scope will n
|
|
|
5151
4611
|
- containerId: [optional] The ID of the realm containing the role.
|
|
5152
4612
|
|
|
5153
4613
|
```js
|
|
4614
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5154
4615
|
|
|
5155
4616
|
// del realm scope mappings
|
|
5156
|
-
const availableRealmRoles= await
|
|
4617
|
+
const availableRealmRoles= await KeycloakManager.clientScopes.delRealmScopeMappings(
|
|
5157
4618
|
{
|
|
5158
4619
|
realm: "myrealm-name",
|
|
5159
4620
|
id: "client-scope-id"
|
|
@@ -5179,9 +4640,10 @@ This allows you to see which realm-level permissions are already assigned to the
|
|
|
5179
4640
|
- realm: [optional] The realm where the client scope is defined.
|
|
5180
4641
|
|
|
5181
4642
|
```js
|
|
4643
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5182
4644
|
|
|
5183
4645
|
// list realm scope mappings
|
|
5184
|
-
const mappedRealmRoles= await
|
|
4646
|
+
const mappedRealmRoles= await KeycloakManager.clientScopes.listRealmScopeMappings({
|
|
5185
4647
|
realm: "myrealm-name",
|
|
5186
4648
|
id: "client-id-scope",
|
|
5187
4649
|
});
|
|
@@ -5200,9 +4662,10 @@ This is useful to see the complete set of realm-level permissions a client scope
|
|
|
5200
4662
|
- realm: [optional] The realm where the client scope is defined.
|
|
5201
4663
|
|
|
5202
4664
|
```js
|
|
4665
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5203
4666
|
|
|
5204
4667
|
// list composite realm scope mappings
|
|
5205
|
-
const mappedRealmRoles= await
|
|
4668
|
+
const mappedRealmRoles= await KeycloakManager.clientScopes.listCompositeRealmScopeMappings({
|
|
5206
4669
|
realm: "myrealm-name",
|
|
5207
4670
|
id: "client-id-scope",
|
|
5208
4671
|
});
|
|
@@ -5236,8 +4699,9 @@ This method requires specifying an alias, the provider type, and configuration s
|
|
|
5236
4699
|
- firstBrokerLoginFlowAlias: [optional] Flow to use on first login.
|
|
5237
4700
|
- config : [optional] Provider-specific configuration, e.g., client ID, client secret, endpoints, etc.
|
|
5238
4701
|
```js
|
|
4702
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5239
4703
|
// create a gidentity provider
|
|
5240
|
-
|
|
4704
|
+
KeycloakManager.identityProviders.create({
|
|
5241
4705
|
alias: "google",
|
|
5242
4706
|
providerId: "google",
|
|
5243
4707
|
enabled: true,
|
|
@@ -5263,8 +4727,9 @@ The mapper defines how attributes, roles, or claims from the Identity Provider a
|
|
|
5263
4727
|
- alias: [required] The alias of the Identity Provider to which the mapper will be attached.
|
|
5264
4728
|
- identityProviderMapper: [required] The mapper configuration object, which includes details like the mapper type, name, and configuration values
|
|
5265
4729
|
```js
|
|
4730
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5266
4731
|
// create a mapper
|
|
5267
|
-
|
|
4732
|
+
KeycloakManager.identityProviders.createMapper({
|
|
5268
4733
|
alias: 'currentIdpAlias',
|
|
5269
4734
|
identityProviderMapper: {
|
|
5270
4735
|
name: "email-mapper",
|
|
@@ -5288,8 +4753,9 @@ These mappers define how attributes, roles, or claims from the external Identity
|
|
|
5288
4753
|
- filter: pparameter provided as a JSON object that accepts the following filter:
|
|
5289
4754
|
- alias: [required] TThe alias of the Identity Provider whose mappers you want to fetch.
|
|
5290
4755
|
```js
|
|
4756
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5291
4757
|
// find a mapper
|
|
5292
|
-
const mappers= await
|
|
4758
|
+
const mappers= await KeycloakManager.identityProviders.findMappers({
|
|
5293
4759
|
alias: 'currentIdpAlias',
|
|
5294
4760
|
|
|
5295
4761
|
});
|
|
@@ -5308,8 +4774,9 @@ This is useful when you need to remove a mapping rule that translates attributes
|
|
|
5308
4774
|
- alias: [required] The alias of the Identity Provider that owns the mapper.
|
|
5309
4775
|
- id : [required] The unique ID of the mapper to be deleted.
|
|
5310
4776
|
```js
|
|
4777
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5311
4778
|
// delete a mapper
|
|
5312
|
-
await
|
|
4779
|
+
await KeycloakManager.identityProviders.delMapper({
|
|
5313
4780
|
alias: 'currentIdpAlias',
|
|
5314
4781
|
id: 'mapperId'
|
|
5315
4782
|
});
|
|
@@ -5327,8 +4794,9 @@ This allows you to inspect a mapper’s configuration, such as how attributes or
|
|
|
5327
4794
|
- alias: [required] The alias of the Identity Provider.
|
|
5328
4795
|
- id: [required] The unique ID of the mapper to retrieve.
|
|
5329
4796
|
```js
|
|
4797
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5330
4798
|
// find a mapper
|
|
5331
|
-
const mapper= await
|
|
4799
|
+
const mapper= await KeycloakManager.identityProviders.findOneMapper({
|
|
5332
4800
|
alias: 'currentIdpAlias',
|
|
5333
4801
|
id: 'mapperId'
|
|
5334
4802
|
});
|
|
@@ -5345,8 +4813,9 @@ After deletion, users will no longer be able to authenticate using that Identity
|
|
|
5345
4813
|
- filter: pparameter provided as a JSON object that accepts the following filter:
|
|
5346
4814
|
- alias: [required] The alias of the Identity Provider you want to delete.
|
|
5347
4815
|
```js
|
|
4816
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5348
4817
|
// delete
|
|
5349
|
-
await
|
|
4818
|
+
await KeycloakManager.identityProviders.del({
|
|
5350
4819
|
alias: 'currentIdpAlias'
|
|
5351
4820
|
});
|
|
5352
4821
|
|
|
@@ -5361,8 +4830,9 @@ It is useful when you need to inspect the provider’s settings, such as its ali
|
|
|
5361
4830
|
- filter: pparameter provided as a JSON object that accepts the following filter:
|
|
5362
4831
|
- alias: [required] The alias of the Identity Provider you want to find.
|
|
5363
4832
|
```js
|
|
4833
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5364
4834
|
// find one
|
|
5365
|
-
const idp= await
|
|
4835
|
+
const idp= await KeycloakManager.identityProviders.findOne({
|
|
5366
4836
|
alias: 'currentIdpAlias'
|
|
5367
4837
|
});
|
|
5368
4838
|
|
|
@@ -5379,8 +4849,9 @@ The method retrieves a list of all configured Identity Providers in the current
|
|
|
5379
4849
|
It allows you to see which providers (e.g., Google, GitHub, SAML, etc.) are available and get their basic configuration details.
|
|
5380
4850
|
|
|
5381
4851
|
```js
|
|
4852
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5382
4853
|
// find
|
|
5383
|
-
const provider= await
|
|
4854
|
+
const provider= await KeycloakManager.identityProviders.find();
|
|
5384
4855
|
|
|
5385
4856
|
console.log("Configured Identity Providers:");
|
|
5386
4857
|
providers.forEach((provider) => {
|
|
@@ -5400,8 +4871,9 @@ It allows you to modify settings such as client ID, secret, authorization URLs,
|
|
|
5400
4871
|
- providerId: [required] The provider type (e.g., "google", "saml").
|
|
5401
4872
|
- Other optional fields like displayName, config object, etc.
|
|
5402
4873
|
```js
|
|
4874
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5403
4875
|
// update one
|
|
5404
|
-
await
|
|
4876
|
+
await KeycloakManager.identityProviders.update(
|
|
5405
4877
|
{ alias: 'currentIdpAlias' },
|
|
5406
4878
|
{
|
|
5407
4879
|
// alias and providerId are required to update
|
|
@@ -5421,8 +4893,9 @@ This is useful when you want to check what configuration options are supported b
|
|
|
5421
4893
|
- filter: pparameter provided as a JSON object that accepts the following filter:
|
|
5422
4894
|
- providerId: [required] The ID of the Identity Provider factory to look up (e.g., "oidc", "saml", "google").
|
|
5423
4895
|
```js
|
|
4896
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5424
4897
|
// find factory
|
|
5425
|
-
const factory= await
|
|
4898
|
+
const factory= await KeycloakManager.identityProviders.findFactory({
|
|
5426
4899
|
providerId: "oidc",
|
|
5427
4900
|
});
|
|
5428
4901
|
|
|
@@ -5440,8 +4913,9 @@ This is useful to list all transformations and mappings applied to users authent
|
|
|
5440
4913
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
5441
4914
|
- alias: [required] The alias of the Identity Provider (set when the provider was created).
|
|
5442
4915
|
```js
|
|
4916
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5443
4917
|
// find one
|
|
5444
|
-
const mappers= await
|
|
4918
|
+
const mappers= await KeycloakManager.identityProviders.findMappers({
|
|
5445
4919
|
alias: "google",
|
|
5446
4920
|
});
|
|
5447
4921
|
|
|
@@ -5457,8 +4931,9 @@ It’s useful when you need to inspect the configuration of a mapper before upda
|
|
|
5457
4931
|
- alias: [required] The alias of the Identity Provider.
|
|
5458
4932
|
- id: [required] The unique ID of the mapper to fetch.
|
|
5459
4933
|
```js
|
|
4934
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5460
4935
|
// find one
|
|
5461
|
-
const mapper= await
|
|
4936
|
+
const mapper= await KeycloakManager.identityProviders.findOneMapper({
|
|
5462
4937
|
alias: "google",
|
|
5463
4938
|
id: "1234-abcd-5678-efgh",
|
|
5464
4939
|
});
|
|
@@ -5486,8 +4961,9 @@ This method allows you to change the configuration of an existing mapper (e.g.,
|
|
|
5486
4961
|
- identityProviderMapper: [optional] The type of mapper (e.g., "oidc-user-attribute-idp-mapper").
|
|
5487
4962
|
- config: [optional] The new mapping configuration.
|
|
5488
4963
|
```js
|
|
4964
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5489
4965
|
// update one Mapper
|
|
5490
|
-
const mappers= await
|
|
4966
|
+
const mappers= await KeycloakManager.identityProviders.updateMapper(
|
|
5491
4967
|
{
|
|
5492
4968
|
alias: "google",
|
|
5493
4969
|
id: "1234-abcd-5678-efgh", // Mapper ID
|
|
@@ -5519,8 +4995,9 @@ This saves you from manually entering configuration details, since Keycloak can
|
|
|
5519
4995
|
- trustEmail: [optional] Whether to automatically trust emails from this IdP.
|
|
5520
4996
|
- alias: [optional] Alias for the Identity Provider (unique name).
|
|
5521
4997
|
```js
|
|
4998
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5522
4999
|
// import one Mapper
|
|
5523
|
-
const mappers= await
|
|
5000
|
+
const mappers= await KeycloakManager.identityProviders.importFromUrl({
|
|
5524
5001
|
fromUrl: "https://accounts.google.com/.well-known/openid-configuration",
|
|
5525
5002
|
providerId: "oidc",
|
|
5526
5003
|
alias: "google",
|
|
@@ -5542,8 +5019,9 @@ When enabled, Keycloak creates client roles (scopes) that let you define which u
|
|
|
5542
5019
|
- realm: [optional] The realm where the IdP is defined.
|
|
5543
5020
|
- other permisssion fields
|
|
5544
5021
|
```js
|
|
5022
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5545
5023
|
// import one permission
|
|
5546
|
-
const updatedPermissions= await
|
|
5024
|
+
const updatedPermissions= await KeycloakManager.identityProviders.updatePermission(
|
|
5547
5025
|
{ alias: "google"},
|
|
5548
5026
|
{ enabled: true }
|
|
5549
5027
|
);
|
|
@@ -5560,8 +5038,9 @@ It returns whether permissions are enabled and, if so, which scope roles are ass
|
|
|
5560
5038
|
- alias: [required] The alias of the Identity Provider.
|
|
5561
5039
|
- realm: [optional] The realm where the IdP is defined.
|
|
5562
5040
|
```js
|
|
5041
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5563
5042
|
// import one permission
|
|
5564
|
-
const permissions= await
|
|
5043
|
+
const permissions= await KeycloakManager.identityProviders.listPermissions({
|
|
5565
5044
|
alias: "google",
|
|
5566
5045
|
realm: "myrealm",
|
|
5567
5046
|
});
|
|
@@ -5590,8 +5069,9 @@ Create a new group in the current realme
|
|
|
5590
5069
|
- {other [optional] group descriprion fields}
|
|
5591
5070
|
|
|
5592
5071
|
```js
|
|
5072
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5593
5073
|
// create a group called my-group
|
|
5594
|
-
|
|
5074
|
+
KeycloakManager.groups.create({name: "my-group"});
|
|
5595
5075
|
```
|
|
5596
5076
|
|
|
5597
5077
|
|
|
@@ -5605,13 +5085,14 @@ Searching by attributes is only available from Keycloak > 15
|
|
|
5605
5085
|
- max: A pagination parameter used to define the maximum number of groups to return (limit).
|
|
5606
5086
|
- first: A pagination parameter used to define the number of groups to skip before starting to return results (offset/limit).
|
|
5607
5087
|
```js
|
|
5088
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5608
5089
|
// find a 100 groups
|
|
5609
|
-
const groups = await
|
|
5090
|
+
const groups = await KeycloakManager.groups.find({ max: 100 });
|
|
5610
5091
|
if(groups) console.log('Groups found:', groups);
|
|
5611
5092
|
else console.log('Groups not found');
|
|
5612
5093
|
|
|
5613
5094
|
// find a 100 groups and skip the first 50
|
|
5614
|
-
groups = await
|
|
5095
|
+
groups = await KeycloakManager.groups.find({ max: 100, first:50 });
|
|
5615
5096
|
if(groups) console.log('Groups found:', groups);
|
|
5616
5097
|
else console.log('Groups not found');
|
|
5617
5098
|
```
|
|
@@ -5620,8 +5101,9 @@ else console.log('Groups not found');
|
|
|
5620
5101
|
findOne is method used to retrieve a specific group's details by their unique identifier (id) within a given realm.
|
|
5621
5102
|
It returns the full group representation if the group exists.
|
|
5622
5103
|
```js
|
|
5104
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5623
5105
|
// find a group with id:'group-id'
|
|
5624
|
-
const group = await
|
|
5106
|
+
const group = await KeycloakManager.groups.findOne({ id: 'group-id' });
|
|
5625
5107
|
if(group) console.log('Group found:', group);
|
|
5626
5108
|
else console.log('Group not found');
|
|
5627
5109
|
```
|
|
@@ -5634,8 +5116,9 @@ Return a promise that resolves when the group is successfully deleted. No conten
|
|
|
5634
5116
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
5635
5117
|
- id: The ID of the group to delete.
|
|
5636
5118
|
```js
|
|
5119
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5637
5120
|
// delete a group with id:'group-id'
|
|
5638
|
-
const group = await
|
|
5121
|
+
const group = await KeycloakManager.groups.del({ id: 'group-id' });
|
|
5639
5122
|
```
|
|
5640
5123
|
|
|
5641
5124
|
|
|
@@ -5647,12 +5130,13 @@ This is useful for pagination, reporting, or general statistics regarding group
|
|
|
5647
5130
|
- realm: [optional] The name of the realm. If omitted, the default realm is used.
|
|
5648
5131
|
- search: [optional] A text string to filter the group count by name.
|
|
5649
5132
|
```js
|
|
5133
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5650
5134
|
// count groups
|
|
5651
|
-
const result = await
|
|
5135
|
+
const result = await KeycloakManager.groups.count();
|
|
5652
5136
|
console.log('Total groups:', result.count);
|
|
5653
5137
|
|
|
5654
5138
|
// count groups with filter
|
|
5655
|
-
const result = await
|
|
5139
|
+
const result = await KeycloakManager.groups.count({ search: "cool-group" });
|
|
5656
5140
|
console.log('Total cool-group groups:', result.count);
|
|
5657
5141
|
|
|
5658
5142
|
```
|
|
@@ -5674,8 +5158,9 @@ You can modify the group’s name, attributes, or hierarchy by providing the gro
|
|
|
5674
5158
|
- description: [optional] the new group Description
|
|
5675
5159
|
- other [optional] group descriprion fields
|
|
5676
5160
|
```js
|
|
5161
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5677
5162
|
// update single group
|
|
5678
|
-
await
|
|
5163
|
+
await KeycloakManager.groups.update(
|
|
5679
5164
|
{ id: 'group-id' },
|
|
5680
5165
|
{ name: "another-group-name", description: "another-group-description" },
|
|
5681
5166
|
);
|
|
@@ -5693,8 +5178,9 @@ This method is useful when navigating hierarchical group structures within a Key
|
|
|
5693
5178
|
- briefRepresentation: [optional] If true, returns a lightweight version of each group (default is true).
|
|
5694
5179
|
- realm: [optional] Realm name.
|
|
5695
5180
|
```js
|
|
5181
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5696
5182
|
// list 10 subgroups
|
|
5697
|
-
await
|
|
5183
|
+
await KeycloakManager.groups.listSubGroups({
|
|
5698
5184
|
parentId: 'gropd-id',
|
|
5699
5185
|
first: 0,
|
|
5700
5186
|
max: 10,
|
|
@@ -5713,8 +5199,9 @@ This operation grants all users within that group the associated realm roles, ef
|
|
|
5713
5199
|
- roles: [required] An array of role(RoleRepresentation) objects to assign.
|
|
5714
5200
|
|
|
5715
5201
|
```js
|
|
5202
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5716
5203
|
// add a role to group
|
|
5717
|
-
await
|
|
5204
|
+
await KeycloakManager.groups.addRealmRoleMappings({
|
|
5718
5205
|
id: 'gropd-id',
|
|
5719
5206
|
// at least id and name should appear
|
|
5720
5207
|
roles: [{
|
|
@@ -5736,8 +5223,9 @@ This helps in identifying which roles are still eligible for addition to the gro
|
|
|
5736
5223
|
Return an array of RoleRepresentation objects representing the assignable realm roles for the group.
|
|
5737
5224
|
|
|
5738
5225
|
```js
|
|
5226
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5739
5227
|
// list available role-mappings
|
|
5740
|
-
const availableRoles= await
|
|
5228
|
+
const availableRoles= await KeycloakManager.groups.listAvailableRealmRoleMappings({
|
|
5741
5229
|
id: 'gropd-id'
|
|
5742
5230
|
});
|
|
5743
5231
|
console.log('Available realm roles for group:', availableRoles);
|
|
@@ -5756,8 +5244,9 @@ Return an object with two arrays:
|
|
|
5756
5244
|
- clientMappings: a map of client IDs to the client-level roles assigned for each client.
|
|
5757
5245
|
|
|
5758
5246
|
```js
|
|
5247
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5759
5248
|
// list role-mappings
|
|
5760
|
-
const roleMappings= await
|
|
5249
|
+
const roleMappings= await KeycloakManager.groups.listRoleMappings({
|
|
5761
5250
|
id: 'gropd-id'
|
|
5762
5251
|
});
|
|
5763
5252
|
console.log('Realm roles:', roleMappings.realmMappings);
|
|
@@ -5775,8 +5264,9 @@ These roles are defined at the realm level and are not tied to any specific clie
|
|
|
5775
5264
|
Return An array of RoleRepresentation objects
|
|
5776
5265
|
|
|
5777
5266
|
```js
|
|
5267
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5778
5268
|
// list realm role-mappings of group
|
|
5779
|
-
const realmRoles= await
|
|
5269
|
+
const realmRoles= await KeycloakManager.groups.listRealmRoleMappings({
|
|
5780
5270
|
id: 'gropd-id'
|
|
5781
5271
|
});
|
|
5782
5272
|
console.log('Realm roles assigned to group:', realmRoles.map(role => role.name));
|
|
@@ -5793,8 +5283,9 @@ This includes both directly assigned roles and those inherited through composite
|
|
|
5793
5283
|
Return An array of RoleRepresentation objects that includes all realm roles, both directly assigned and inherited via composite roles.
|
|
5794
5284
|
|
|
5795
5285
|
```js
|
|
5286
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5796
5287
|
// List realm composite role-mappings of group
|
|
5797
|
-
const compositeRealmRoles= await
|
|
5288
|
+
const compositeRealmRoles= await KeycloakManager.groups.listCompositeRealmRoleMappings({
|
|
5798
5289
|
id: 'gropd-id'
|
|
5799
5290
|
});
|
|
5800
5291
|
console.log('All (composite) realm roles for group:', compositeRealmRoles.map(role => role.name));
|
|
@@ -5811,8 +5302,9 @@ Composite roles inherited indirectly will not be removed.
|
|
|
5811
5302
|
- roles: [required] Array of roles to be removed
|
|
5812
5303
|
|
|
5813
5304
|
```js
|
|
5305
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5814
5306
|
// Delete realm role-mappings from group
|
|
5815
|
-
await
|
|
5307
|
+
await KeycloakManager.groups.delRealmRoleMappings({
|
|
5816
5308
|
id: 'gropd-id',
|
|
5817
5309
|
// at least id and name should appear
|
|
5818
5310
|
roles: [{
|
|
@@ -5833,8 +5325,9 @@ This allows all users belonging to that group to inherit the specified roles for
|
|
|
5833
5325
|
- roles: [required] Array of client roles to assign to the group
|
|
5834
5326
|
|
|
5835
5327
|
```js
|
|
5328
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5836
5329
|
// add a client role to group
|
|
5837
|
-
await
|
|
5330
|
+
await KeycloakManager.groups.addClientRoleMappings({
|
|
5838
5331
|
id: 'gropd-id',
|
|
5839
5332
|
clientUniqueId:'internal-client-id',
|
|
5840
5333
|
// at least id and name should appear
|
|
@@ -5855,8 +5348,9 @@ This is useful when you want to show assignable roles for a group in a specific
|
|
|
5855
5348
|
- clientUniqueId: [required] The internal ID of the client
|
|
5856
5349
|
|
|
5857
5350
|
```js
|
|
5351
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5858
5352
|
// list available client role-mappings for group
|
|
5859
|
-
const availableRoles= await
|
|
5353
|
+
const availableRoles= await KeycloakManager.groups.listAvailableClientRoleMappings({
|
|
5860
5354
|
id: 'gropd-id',
|
|
5861
5355
|
clientUniqueId:'internal-client-id',
|
|
5862
5356
|
});
|
|
@@ -5873,8 +5367,9 @@ This allows you to see which roles from a client the group already has.
|
|
|
5873
5367
|
- clientUniqueId: [required] The internal ID of the client
|
|
5874
5368
|
|
|
5875
5369
|
```js
|
|
5370
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5876
5371
|
// list client role-mappings of group
|
|
5877
|
-
const availableRoles= await
|
|
5372
|
+
const availableRoles= await KeycloakManager.groups.listClientRoleMappings({
|
|
5878
5373
|
id: 'gropd-id',
|
|
5879
5374
|
clientUniqueId:'internal-client-id',
|
|
5880
5375
|
});
|
|
@@ -5891,8 +5386,9 @@ Composite roles are roles that aggregate other roles, so this method returns cli
|
|
|
5891
5386
|
- clientUniqueId: [required] The internal ID of the client
|
|
5892
5387
|
|
|
5893
5388
|
```js
|
|
5389
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5894
5390
|
// list composite client role-mappings for group
|
|
5895
|
-
const compositeClientRoles= await
|
|
5391
|
+
const compositeClientRoles= await KeycloakManager.groups.listCompositeClientRoleMappings({
|
|
5896
5392
|
id: 'gropd-id',
|
|
5897
5393
|
clientUniqueId:'internal-client-id',
|
|
5898
5394
|
});
|
|
@@ -5910,8 +5406,9 @@ This function deletes one or more client roles that were assigned to the group,
|
|
|
5910
5406
|
- roles: An array of role objects(RoleRepresentation) representing the client roles to be removed
|
|
5911
5407
|
|
|
5912
5408
|
```js
|
|
5409
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5913
5410
|
// delete the created role
|
|
5914
|
-
await
|
|
5411
|
+
await KeycloakManager.groups.delClientRoleMappings({
|
|
5915
5412
|
id: 'gropd-id',
|
|
5916
5413
|
clientUniqueId:'internal-client-id',
|
|
5917
5414
|
roles: [
|
|
@@ -5935,8 +5432,9 @@ It allows you to create, update, inspect, and delete both realm-level and client
|
|
|
5935
5432
|
##### `function create(role_dictionary)`
|
|
5936
5433
|
Create a new role
|
|
5937
5434
|
```js
|
|
5435
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5938
5436
|
// create a role name called my-role
|
|
5939
|
-
|
|
5437
|
+
KeycloakManager.roles.create({name:'my-role'});
|
|
5940
5438
|
```
|
|
5941
5439
|
##### `function createComposite(filters,[roles])`
|
|
5942
5440
|
Create a new composite role. Composite roles in Keycloak are roles that combine other roles,
|
|
@@ -5956,6 +5454,7 @@ When you assign a composite role to a user, they automatically inherit all the r
|
|
|
5956
5454
|
|
|
5957
5455
|
|
|
5958
5456
|
```js
|
|
5457
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5959
5458
|
// create a composite role where "admin" include anche "reader".
|
|
5960
5459
|
const adminRole = await client.roles.findOneByName({ name: 'admin' });
|
|
5961
5460
|
const readerRole = await client.roles.findOneByName({ name: 'reader' });
|
|
@@ -5971,7 +5470,8 @@ get all realm roles and return a JSON
|
|
|
5971
5470
|
- first (number, optional): Index of the first result to return (used for pagination).
|
|
5972
5471
|
- max (number, optional): Maximum number of results to return.
|
|
5973
5472
|
```js
|
|
5974
|
-
|
|
5473
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5474
|
+
KeycloakManager.roles.find();
|
|
5975
5475
|
```
|
|
5976
5476
|
##### `function findOneByName(filters)`
|
|
5977
5477
|
Get a role by name
|
|
@@ -5980,8 +5480,9 @@ Get a role by name
|
|
|
5980
5480
|
- name (string, required) — The exact name of the role to retrieve.
|
|
5981
5481
|
- realm (string, optional if set globally) — The realm where the role is defined.
|
|
5982
5482
|
```js
|
|
5483
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5983
5484
|
// get information about 'my-role' role
|
|
5984
|
-
|
|
5485
|
+
KeycloakManager.roles.findOneByName({ name: 'my-role' });
|
|
5985
5486
|
```
|
|
5986
5487
|
|
|
5987
5488
|
##### `function findOneById(filters)`
|
|
@@ -5991,8 +5492,9 @@ Get a role by its Id
|
|
|
5991
5492
|
- Id (string, required) — The Id of the role to retrieve.
|
|
5992
5493
|
- realm (string, optional if set globally) — The realm where the role is defined.
|
|
5993
5494
|
```js
|
|
5495
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5994
5496
|
// get information about 'my-role-id' role
|
|
5995
|
-
|
|
5497
|
+
KeycloakManager.roles.findOneById({ id: 'my-role-id' });
|
|
5996
5498
|
```
|
|
5997
5499
|
|
|
5998
5500
|
##### `function updateByName(filters,role_dictionary)`
|
|
@@ -6003,8 +5505,9 @@ Update a role by its name
|
|
|
6003
5505
|
- realm (string, optional if set globally) — The realm where the role is defined.
|
|
6004
5506
|
- role_dictionary: A JSON object representing a role dictionary as defined in Keycloak
|
|
6005
5507
|
```js
|
|
5508
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6006
5509
|
// update 'my-role' role with a new description
|
|
6007
|
-
|
|
5510
|
+
KeycloakManager.roles.updateByName({ name: 'my-role' }, {description:"new Description"});
|
|
6008
5511
|
```
|
|
6009
5512
|
|
|
6010
5513
|
##### `function updateById(filters,role_dictionary)`
|
|
@@ -6015,8 +5518,9 @@ Update a role by its Id
|
|
|
6015
5518
|
- realm (string, optional if set globally) — The realm where the role is defined.
|
|
6016
5519
|
- role_dictionary: A JSON object representing a role dictionary as defined in Keycloak
|
|
6017
5520
|
```js
|
|
5521
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6018
5522
|
// update role by id 'my-role-id' with a new description
|
|
6019
|
-
|
|
5523
|
+
KeycloakManager.roles.updateById({ id: 'my-role-id' }, {description:"new Description"});
|
|
6020
5524
|
```
|
|
6021
5525
|
|
|
6022
5526
|
##### `function delByName(filters)`
|
|
@@ -6026,8 +5530,9 @@ Delete a role by its name
|
|
|
6026
5530
|
- name (string, required) — The exact name of the role to retrieve.
|
|
6027
5531
|
- realm (string, optional if set globally) — The realm where the role is defined.
|
|
6028
5532
|
```js
|
|
5533
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6029
5534
|
// delete role 'my-role'
|
|
6030
|
-
|
|
5535
|
+
KeycloakManager.roles.delByName({ name: 'my-role' });
|
|
6031
5536
|
```
|
|
6032
5537
|
|
|
6033
5538
|
##### `function findUsersWithRole(filters)`
|
|
@@ -6037,18 +5542,20 @@ Find all users associated with a specific role
|
|
|
6037
5542
|
- id: (string, optional) — The Id of the role to retrieve.
|
|
6038
5543
|
- realm: (string, optional if set globally) — The realm where the role is defined.
|
|
6039
5544
|
```js
|
|
5545
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6040
5546
|
// Find all users associated with role named 'my-role'
|
|
6041
|
-
|
|
5547
|
+
KeycloakManager.roles.findUsersWithRole({ name: 'my-role' });
|
|
6042
5548
|
```
|
|
6043
5549
|
|
|
6044
5550
|
##### `function getCompositeRoles(filters)`
|
|
6045
5551
|
Find all composite roles associated with a specific role.
|
|
6046
5552
|
- filters: parameter provided as a JSON object that accepts the following parameters:
|
|
6047
5553
|
- name: (string, optional) — The exact name of the role to retrieve.
|
|
6048
|
-
- id: (string, optional) — The
|
|
5554
|
+
- id: (string, optional) — The id of the role to retrieve.
|
|
6049
5555
|
```js
|
|
5556
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6050
5557
|
// Find all composite role named 'my-role' and id 'my-role-id'
|
|
6051
|
-
|
|
5558
|
+
KeycloakManager.roles.getCompositeRoles({ id: 'my-role-id' });
|
|
6052
5559
|
```
|
|
6053
5560
|
|
|
6054
5561
|
##### `function getCompositeRolesForRealm({roleId:roleid})`
|
|
@@ -6064,7 +5571,8 @@ for understanding and managing hierarchical role structures within a realm in Ke
|
|
|
6064
5571
|
- filters: parameter provided as a JSON object that accepts the following parameters:
|
|
6065
5572
|
- roleId: (string, required) — The Id of the role to retrieve.
|
|
6066
5573
|
```js
|
|
6067
|
-
const
|
|
5574
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5575
|
+
const compositeRoles = await KeycloakManager.roles.getCompositeRolesForRealm({ roleId: 'role-id' });
|
|
6068
5576
|
console.log('admin composite roles:', compositeRoles.map(r => r.name));
|
|
6069
5577
|
|
|
6070
5578
|
```
|
|
@@ -6081,9 +5589,10 @@ This helps manage and inspect client-specific role hierarchies within the compos
|
|
|
6081
5589
|
@parameters:
|
|
6082
5590
|
- filters: parameter provided as a JSON object that accepts the following parameters:
|
|
6083
5591
|
- roleId: (string, required) — The Id of the role to retrieve
|
|
6084
|
-
- clientId: (string, required) — The
|
|
5592
|
+
- clientId: (string, required) — The id of the client to search for composite roles
|
|
6085
5593
|
```js
|
|
6086
|
-
const
|
|
5594
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
5595
|
+
const compositeRoles = await KeycloakManager.roles.getCompositeRolesForClient({
|
|
6087
5596
|
roleId: 'compositeRole-Id',
|
|
6088
5597
|
clientId: 'client-Id'
|
|
6089
5598
|
});
|
|
@@ -6117,8 +5626,9 @@ Components are modular providers in Keycloak, such as user federation providers
|
|
|
6117
5626
|
- bindCredential: ["secret"],
|
|
6118
5627
|
- usersDn: ["ou=users,dc=example,dc=com"]
|
|
6119
5628
|
```js
|
|
5629
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6120
5630
|
// create a component called my-ldap
|
|
6121
|
-
const newComponent= await
|
|
5631
|
+
const newComponent= await KeycloakManager.components.create({
|
|
6122
5632
|
name: "my-ldap",
|
|
6123
5633
|
providerId: "ldap",
|
|
6124
5634
|
providerType: "org.keycloak.storage.UserStorageProvider",
|
|
@@ -6156,8 +5666,9 @@ protocol mappers, authenticator factories, or other custom integrations.
|
|
|
6156
5666
|
- bindCredential: ["secret"],
|
|
6157
5667
|
- usersDn: ["ou=users,dc=example,dc=com"]
|
|
6158
5668
|
```js
|
|
5669
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6159
5670
|
// update a component
|
|
6160
|
-
await
|
|
5671
|
+
await KeycloakManager.components.update(
|
|
6161
5672
|
{id:'component-id'},
|
|
6162
5673
|
{
|
|
6163
5674
|
name: "my-ldap",
|
|
@@ -6185,8 +5696,9 @@ Components in Keycloak represent pluggable providers such as LDAP user federatio
|
|
|
6185
5696
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6186
5697
|
- id: [required] The unique ID of the component to retrieve.
|
|
6187
5698
|
```js
|
|
5699
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6188
5700
|
// find one by Id
|
|
6189
|
-
component = await
|
|
5701
|
+
component = await KeycloakManager.components.findOne({
|
|
6190
5702
|
id: "component-id",
|
|
6191
5703
|
});
|
|
6192
5704
|
|
|
@@ -6208,8 +5720,9 @@ You can optionally filter components by their parent ID and/or provider type (e.
|
|
|
6208
5720
|
- max: A pagination parameter used to define the maximum number of components to return (limit).
|
|
6209
5721
|
- first: A pagination parameter used to define the number of components to skip before starting to return results (offset/limit).
|
|
6210
5722
|
```js
|
|
5723
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6211
5724
|
// find by Id
|
|
6212
|
-
component = await
|
|
5725
|
+
component = await KeycloakManager.components.find({
|
|
6213
5726
|
id: "component-id",
|
|
6214
5727
|
});
|
|
6215
5728
|
|
|
@@ -6230,8 +5743,9 @@ Components include user federation providers (e.g., LDAP, Kerberos), authenticat
|
|
|
6230
5743
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6231
5744
|
- id: [required] The unique ID of the component to delete.
|
|
6232
5745
|
```js
|
|
5746
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6233
5747
|
// del one by Id
|
|
6234
|
-
await
|
|
5748
|
+
await KeycloakManager.components.del({
|
|
6235
5749
|
id: "component-id",
|
|
6236
5750
|
});
|
|
6237
5751
|
|
|
@@ -6250,8 +5764,9 @@ This is useful when working with hierarchical components, for example:
|
|
|
6250
5764
|
- id: [required] The ID of the parent component.
|
|
6251
5765
|
- type: [optional] Filters sub-components by their provider type (e.g., "org.keycloak.protocol.mapper.ProtocolMapper").
|
|
6252
5766
|
```js
|
|
5767
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6253
5768
|
// del one by Id
|
|
6254
|
-
const subComponents= await
|
|
5769
|
+
const subComponents= await KeycloakManager.components.listSubComponents({
|
|
6255
5770
|
id: "component-id",
|
|
6256
5771
|
type: "org.keycloak.protocol.mapper.ProtocolMapper",
|
|
6257
5772
|
});
|
|
@@ -6291,8 +5806,9 @@ By deleting a required action, it will no longer be available for assignment to
|
|
|
6291
5806
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6292
5807
|
- alias: [required] The unique alias of the required action to delete (e.g., "UPDATE_PASSWORD").
|
|
6293
5808
|
```js
|
|
5809
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6294
5810
|
// del one by Id
|
|
6295
|
-
const subComponents= await
|
|
5811
|
+
const subComponents= await KeycloakManager.authenticationManagement.deleteRequiredAction({
|
|
6296
5812
|
alias: "UPDATE_PROFILE",
|
|
6297
5813
|
});
|
|
6298
5814
|
|
|
@@ -6316,8 +5832,9 @@ This method is typically used after checking available actions via getUnregister
|
|
|
6316
5832
|
- priority: [optional] Determines the execution order among required actions.
|
|
6317
5833
|
- config: [optional] Extra configuration options (usually empty for built-in actions).
|
|
6318
5834
|
```js
|
|
5835
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6319
5836
|
// register required action
|
|
6320
|
-
const subComponents= await
|
|
5837
|
+
const subComponents= await KeycloakManager.authenticationManagement.registerRequiredAction({
|
|
6321
5838
|
providerId: "terms_and_conditions",
|
|
6322
5839
|
name: "Terms and Conditions",
|
|
6323
5840
|
description: "Require user to accept terms before continuing",
|
|
@@ -6337,8 +5854,9 @@ The method retrieves all available required actions that exist in Keycloak but a
|
|
|
6337
5854
|
This is useful if you want to see which built-in or custom required actions can still be added to the realm (e.g., custom scripts, OTP setup, email verification).
|
|
6338
5855
|
|
|
6339
5856
|
```js
|
|
5857
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6340
5858
|
// get unregistered required actions
|
|
6341
|
-
const unregistered= await
|
|
5859
|
+
const unregistered= await KeycloakManager.authenticationManagement.getUnregisteredRequiredActions();
|
|
6342
5860
|
|
|
6343
5861
|
console.log("Unregistered required actions:", unregistered);
|
|
6344
5862
|
|
|
@@ -6354,8 +5872,9 @@ Required actions are tasks that users may be required to perform during authenti
|
|
|
6354
5872
|
- others...
|
|
6355
5873
|
|
|
6356
5874
|
```js
|
|
5875
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6357
5876
|
// get required actions
|
|
6358
|
-
const requiredActions= await
|
|
5877
|
+
const requiredActions= await KeycloakManager.authenticationManagement.getRequiredActions();
|
|
6359
5878
|
|
|
6360
5879
|
console.log("Registered required actions:", requiredActions);
|
|
6361
5880
|
|
|
@@ -6370,8 +5889,9 @@ This method is useful when you want details about a specific required action wit
|
|
|
6370
5889
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6371
5890
|
- alias: [required] The unique alias of the required action to retrieve (e.g., "UPDATE_PASSWORD").
|
|
6372
5891
|
```js
|
|
5892
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6373
5893
|
// get required action for alias
|
|
6374
|
-
const requiredAction= await
|
|
5894
|
+
const requiredAction= await KeycloakManager.authenticationManagement.getRequiredActionForAlias({
|
|
6375
5895
|
alias:'UPDATE_PASSWORD'
|
|
6376
5896
|
});
|
|
6377
5897
|
|
|
@@ -6387,8 +5907,9 @@ Priority determines the order in which required actions are executed for a user
|
|
|
6387
5907
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6388
5908
|
- alias: [required] The alias (providerId) of the required action to modify.
|
|
6389
5909
|
```js
|
|
5910
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6390
5911
|
// Lower required action priority
|
|
6391
|
-
await
|
|
5912
|
+
await KeycloakManager.authenticationManagement.lowerRequiredActionPriority({
|
|
6392
5913
|
alias:'UPDATE_PASSWORD'
|
|
6393
5914
|
});
|
|
6394
5915
|
|
|
@@ -6405,8 +5926,9 @@ Raising the priority moves the action higher in the execution order, meaning it
|
|
|
6405
5926
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6406
5927
|
- alias: [required] The alias (providerId) of the required action to modify.
|
|
6407
5928
|
```js
|
|
5929
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6408
5930
|
// raise required action priority
|
|
6409
|
-
await
|
|
5931
|
+
await KeycloakManager.authenticationManagement.raiseRequiredActionPriority({
|
|
6410
5932
|
alias:'UPDATE_PASSWORD'
|
|
6411
5933
|
});
|
|
6412
5934
|
|
|
@@ -6422,8 +5944,9 @@ This includes details about the configurable options available for that required
|
|
|
6422
5944
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6423
5945
|
- alias: [required] The alias (providerId) of the required action.
|
|
6424
5946
|
```js
|
|
5947
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6425
5948
|
// Get required action config description
|
|
6426
|
-
const configDescription= await
|
|
5949
|
+
const configDescription= await KeycloakManager.authenticationManagement.getRequiredActionConfigDescription({
|
|
6427
5950
|
alias: "CONFIGURE_OTP",
|
|
6428
5951
|
});
|
|
6429
5952
|
|
|
@@ -6440,8 +5963,9 @@ This allows you to see the settings that have been applied to a required action,
|
|
|
6440
5963
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6441
5964
|
- alias: [required] The alias (providerId) of the required action.
|
|
6442
5965
|
```js
|
|
5966
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6443
5967
|
// Get required action config
|
|
6444
|
-
const config= await
|
|
5968
|
+
const config= await KeycloakManager.authenticationManagement.getRequiredActionConfig({
|
|
6445
5969
|
alias: "CONFIGURE_OTP",
|
|
6446
5970
|
});
|
|
6447
5971
|
|
|
@@ -6457,8 +5981,9 @@ This removes any customized settings for the action, effectively resetting it to
|
|
|
6457
5981
|
- filter: parameter provided as a JSON object that accepts the following filter:
|
|
6458
5982
|
- alias: [required] The alias (providerId) of the required action.
|
|
6459
5983
|
```js
|
|
5984
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6460
5985
|
// Remove required action config
|
|
6461
|
-
await
|
|
5986
|
+
await KeycloakManager.authenticationManagement.removeRequiredActionConfig({
|
|
6462
5987
|
alias: "CONFIGURE_OTP",
|
|
6463
5988
|
});
|
|
6464
5989
|
|
|
@@ -6490,8 +6015,9 @@ This method allows you to modify attributes such as enabled, defaultAction, prio
|
|
|
6490
6015
|
- config: [optional] Extra configuration.
|
|
6491
6016
|
|
|
6492
6017
|
```js
|
|
6018
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6493
6019
|
// update required action
|
|
6494
|
-
const requiredAction= await
|
|
6020
|
+
const requiredAction= await KeycloakManager.authenticationManagement.updateRequiredAction(
|
|
6495
6021
|
{ alias: "VERIFY_EMAIL" },
|
|
6496
6022
|
{
|
|
6497
6023
|
providerId: "VERIFY_EMAIL",
|
|
@@ -6519,8 +6045,9 @@ This allows you to modify settings such as OTP policies, password requirements,
|
|
|
6519
6045
|
|
|
6520
6046
|
|
|
6521
6047
|
```js
|
|
6048
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6522
6049
|
// update required action config
|
|
6523
|
-
const requiredAction= await
|
|
6050
|
+
const requiredAction= await KeycloakManager.authenticationManagement.updateRequiredActionConfig(
|
|
6524
6051
|
{ alias: "VERIFY_EMAIL" },
|
|
6525
6052
|
{
|
|
6526
6053
|
max_auth_age: "301",
|
|
@@ -6545,8 +6072,9 @@ This method is useful for configuring client authentication flows and assigning
|
|
|
6545
6072
|
|
|
6546
6073
|
|
|
6547
6074
|
```js
|
|
6075
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6548
6076
|
// Get client authenticator providers
|
|
6549
|
-
const clientAuthenticators= await
|
|
6077
|
+
const clientAuthenticators= await KeycloakManager.authenticationManagement.getClientAuthenticatorProviders();
|
|
6550
6078
|
|
|
6551
6079
|
console.log("Client authenticator providers:", clientAuthenticators);
|
|
6552
6080
|
|
|
@@ -6564,8 +6092,9 @@ Form action providers are used during authentication flows to perform specific a
|
|
|
6564
6092
|
This method is useful for configuring authentication flows that require specific user interactions.
|
|
6565
6093
|
|
|
6566
6094
|
```js
|
|
6095
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6567
6096
|
// Get form action providers
|
|
6568
|
-
const formActions= await
|
|
6097
|
+
const formActions= await KeycloakManager.authenticationManagement.getFormActionProviders();
|
|
6569
6098
|
|
|
6570
6099
|
console.log("Form action providers:", formActions);
|
|
6571
6100
|
|
|
@@ -6582,8 +6111,9 @@ Authenticators are used in authentication flows to verify users or perform speci
|
|
|
6582
6111
|
This method is useful for configuring authentication flows and adding or replacing authenticators.
|
|
6583
6112
|
|
|
6584
6113
|
```js
|
|
6114
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6585
6115
|
// Get authenticator providers
|
|
6586
|
-
const authenticators= await
|
|
6116
|
+
const authenticators= await KeycloakManager.authenticationManagement.getAuthenticatorProviders();
|
|
6587
6117
|
|
|
6588
6118
|
|
|
6589
6119
|
console.log("Authenticator providers:", authenticators);
|
|
@@ -6602,8 +6132,9 @@ Form providers are used in authentication flows to render or handle user-facing
|
|
|
6602
6132
|
This method is useful for configuring authentication flows that require user interaction through forms.
|
|
6603
6133
|
|
|
6604
6134
|
```js
|
|
6135
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6605
6136
|
// Get form providers
|
|
6606
|
-
const forms= await
|
|
6137
|
+
const forms= await KeycloakManager.authenticationManagement.getFormProviders();
|
|
6607
6138
|
|
|
6608
6139
|
|
|
6609
6140
|
|
|
@@ -6618,8 +6149,9 @@ Authentication flows define the sequence of authenticators and required actions
|
|
|
6618
6149
|
This method allows you to inspect existing flows, including built-in flows like browser, direct grant, or registration, as well as custom flows.
|
|
6619
6150
|
|
|
6620
6151
|
```js
|
|
6152
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6621
6153
|
// Get flows
|
|
6622
|
-
const flows= await
|
|
6154
|
+
const flows= await KeycloakManager.authenticationManagement.getFlows();
|
|
6623
6155
|
|
|
6624
6156
|
console.log("Authentication flows:", flows);
|
|
6625
6157
|
|
|
@@ -6640,8 +6172,9 @@ This method is useful for inspecting or modifying a particular flow.
|
|
|
6640
6172
|
- authenticationExecutions: [optional] Executions to include in the flow.
|
|
6641
6173
|
|
|
6642
6174
|
```js
|
|
6175
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6643
6176
|
// Create flow
|
|
6644
|
-
await
|
|
6177
|
+
await KeycloakManager.authenticationManagement.createFlow({
|
|
6645
6178
|
alias: "custom-browser-flow",
|
|
6646
6179
|
description: "Custom browser authentication flow",
|
|
6647
6180
|
providerId: "basic-flow",
|
|
@@ -6671,8 +6204,9 @@ filter: Parameter provided as a JSON object that accepts the following filter:
|
|
|
6671
6204
|
- authenticationExecutions: [optional] Executions to include in the flow.
|
|
6672
6205
|
|
|
6673
6206
|
```js
|
|
6207
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6674
6208
|
// Update flow
|
|
6675
|
-
await
|
|
6209
|
+
await KeycloakManager.authenticationManagement.updateFlow(
|
|
6676
6210
|
{ flowId:'flow-id' },
|
|
6677
6211
|
{
|
|
6678
6212
|
alias: "custom-browser-flow",
|
|
@@ -6699,8 +6233,9 @@ filter: Parameter provided as a JSON object that accepts the following filter:
|
|
|
6699
6233
|
- flowId: [required] The id of the source flow to update.
|
|
6700
6234
|
|
|
6701
6235
|
```js
|
|
6236
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6702
6237
|
// Delete flow
|
|
6703
|
-
await
|
|
6238
|
+
await KeycloakManager.authenticationManagement.deleteFlow({
|
|
6704
6239
|
flowId:'flow-id'
|
|
6705
6240
|
});
|
|
6706
6241
|
|
|
@@ -6718,8 +6253,9 @@ This is useful for creating a custom flow based on an existing built-in or custo
|
|
|
6718
6253
|
- newName: [required] The alias of the new copied flow.
|
|
6719
6254
|
|
|
6720
6255
|
```js
|
|
6256
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6721
6257
|
// Copy flow
|
|
6722
|
-
await
|
|
6258
|
+
await KeycloakManager.authenticationManagement.copyFlow({
|
|
6723
6259
|
flow: "browser",
|
|
6724
6260
|
newName: "custom-browser-flow"
|
|
6725
6261
|
});
|
|
@@ -6739,8 +6275,9 @@ This method is useful for inspecting or modifying a particular flow.
|
|
|
6739
6275
|
- flowId: [required] The id of the authentication flow to retrieve
|
|
6740
6276
|
|
|
6741
6277
|
```js
|
|
6278
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6742
6279
|
// Get flows
|
|
6743
|
-
const flow= await
|
|
6280
|
+
const flow= await KeycloakManager.authenticationManagement.getFlow({
|
|
6744
6281
|
flowId:'flow.id'
|
|
6745
6282
|
});
|
|
6746
6283
|
|
|
@@ -6763,8 +6300,9 @@ This method is useful to inspect or modify the steps of a flow.
|
|
|
6763
6300
|
- flow: [required] The alias of the authentication flow whose executions you want to retrieve.
|
|
6764
6301
|
|
|
6765
6302
|
```js
|
|
6303
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6766
6304
|
// Get executions
|
|
6767
|
-
const executions= await
|
|
6305
|
+
const executions= await KeycloakManager.authenticationManagement.getExecutions({
|
|
6768
6306
|
flow:'browser'
|
|
6769
6307
|
});
|
|
6770
6308
|
|
|
@@ -6788,8 +6326,9 @@ This method allows you to extend a flow with additional steps or subflows.
|
|
|
6788
6326
|
- authenticatorFlow: [optional] Boolean indicating if the execution is a nested flow
|
|
6789
6327
|
|
|
6790
6328
|
```js
|
|
6329
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6791
6330
|
// add execution to flow
|
|
6792
|
-
await
|
|
6331
|
+
await KeycloakManager.authenticationManagement.addExecutionToFlow({
|
|
6793
6332
|
flow: "browser",
|
|
6794
6333
|
provider: "auth-otp-form",
|
|
6795
6334
|
});
|
|
@@ -6811,8 +6350,9 @@ This allows you to nest flows, creating complex authentication sequences where o
|
|
|
6811
6350
|
- description: [optional] A human-readable description of the subflow.
|
|
6812
6351
|
|
|
6813
6352
|
```js
|
|
6353
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6814
6354
|
// add flow to flow
|
|
6815
|
-
const flow= await
|
|
6355
|
+
const flow= await KeycloakManager.authenticationManagement.addFlowToFlow({
|
|
6816
6356
|
flow: "browser",
|
|
6817
6357
|
alias: "subFlow",
|
|
6818
6358
|
description: "",
|
|
@@ -6841,8 +6381,9 @@ Executions are individual authenticators or subflows within a flow, and this met
|
|
|
6841
6381
|
|
|
6842
6382
|
|
|
6843
6383
|
```js
|
|
6384
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6844
6385
|
// Update execution
|
|
6845
|
-
await
|
|
6386
|
+
await KeycloakManager.authenticationManagement.updateExecution(
|
|
6846
6387
|
{ flow: "browser" },
|
|
6847
6388
|
{
|
|
6848
6389
|
id: "exec1-abc",
|
|
@@ -6866,8 +6407,9 @@ Executions are individual authenticators or subflows within a flow, and this met
|
|
|
6866
6407
|
|
|
6867
6408
|
|
|
6868
6409
|
```js
|
|
6410
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6869
6411
|
// Dell execution
|
|
6870
|
-
await
|
|
6412
|
+
await KeycloakManager.authenticationManagement.delExecution({
|
|
6871
6413
|
id: "exececution-id"
|
|
6872
6414
|
});
|
|
6873
6415
|
|
|
@@ -6886,8 +6428,9 @@ Increasing the priority moves the execution earlier in the flow sequence, affect
|
|
|
6886
6428
|
|
|
6887
6429
|
|
|
6888
6430
|
```js
|
|
6431
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6889
6432
|
// raise priority execution
|
|
6890
|
-
await
|
|
6433
|
+
await KeycloakManager.authenticationManagement.raisePriorityExecution({
|
|
6891
6434
|
id: "exececution-id"
|
|
6892
6435
|
});
|
|
6893
6436
|
|
|
@@ -6905,8 +6448,9 @@ Lowering the priority moves the execution later in the flow sequence, affecting
|
|
|
6905
6448
|
|
|
6906
6449
|
|
|
6907
6450
|
```js
|
|
6451
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6908
6452
|
// lower priority execution
|
|
6909
|
-
await
|
|
6453
|
+
await KeycloakManager.authenticationManagement.lowerPriorityExecution({
|
|
6910
6454
|
id: "exececution-id"
|
|
6911
6455
|
});
|
|
6912
6456
|
|
|
@@ -6926,8 +6470,9 @@ Configurations allow you to customize the behavior of an authenticator or requir
|
|
|
6926
6470
|
|
|
6927
6471
|
|
|
6928
6472
|
```js
|
|
6473
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6929
6474
|
// Create config
|
|
6930
|
-
const config= await
|
|
6475
|
+
const config= await KeycloakManager.authenticationManagement.createConfig({
|
|
6931
6476
|
id: 'execution-id',
|
|
6932
6477
|
alias: "test",
|
|
6933
6478
|
});
|
|
@@ -6946,8 +6491,9 @@ Configurations define additional settings for authenticators or required actions
|
|
|
6946
6491
|
|
|
6947
6492
|
|
|
6948
6493
|
```js
|
|
6494
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6949
6495
|
// Get config
|
|
6950
|
-
const config= await
|
|
6496
|
+
const config= await KeycloakManager.authenticationManagement.getConfig({
|
|
6951
6497
|
id: 'execution-id',
|
|
6952
6498
|
});
|
|
6953
6499
|
|
|
@@ -6967,8 +6513,9 @@ This allows you to modify existing settings, such as OTP policies, password rule
|
|
|
6967
6513
|
|
|
6968
6514
|
|
|
6969
6515
|
```js
|
|
6516
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6970
6517
|
// Update config
|
|
6971
|
-
await
|
|
6518
|
+
await KeycloakManager.authenticationManagement.updateConfig({
|
|
6972
6519
|
id: 'config-id',
|
|
6973
6520
|
config:{
|
|
6974
6521
|
defaultProvider: "stringa"
|
|
@@ -6990,8 +6537,9 @@ This is useful for removing obsolete or unwanted settings from a required action
|
|
|
6990
6537
|
|
|
6991
6538
|
|
|
6992
6539
|
```js
|
|
6540
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
6993
6541
|
// del config
|
|
6994
|
-
await
|
|
6542
|
+
await KeycloakManager.authenticationManagement.delConfig({
|
|
6995
6543
|
id: 'config-id',
|
|
6996
6544
|
});
|
|
6997
6545
|
|
|
@@ -7017,8 +6565,9 @@ This is useful for dynamically generating forms for configuring required actions
|
|
|
7017
6565
|
|
|
7018
6566
|
|
|
7019
6567
|
```js
|
|
6568
|
+
const KeycloakManager = require('keycloak-api-manager');
|
|
7020
6569
|
// Get config description
|
|
7021
|
-
const configDescription= await
|
|
6570
|
+
const configDescription= await KeycloakManager.authenticationManagement.getConfigDescription({
|
|
7022
6571
|
providerId: 'provider-id',
|
|
7023
6572
|
});
|
|
7024
6573
|
|