Client Owner Manager
This module provides an extension to Keycloak so clients can be linked and managed by specific users.
An example of all the possible requests that can be done to the API can be found in https://www.getpostman.com/collections/d5601317d3dbcf9c6421. This queries can be tested using Postman.
Build and deployment
Builds are created by using Maven. Make sure to have an updated version of Maven (>3.3.0)or
builds might not work properly. Maven will handle fetching dependencies following the
indications in pom.xml and save the build in the target directory.
The output is a
JAR file including the compiled java files and metadata.
In case new dependencies are required, there is the
file, which includes and declares all the dependencies required, and where the list should
be updated. Including this file allows an easier deployment using WildFly.
Deployment Using Docker
Using Travis CI, a new image based on
are created. The Dockerfiles can be found in the distribution folder. In general, the only
thing done is compiling the JAR file and adding it to the
folder, which automatically registers the application with JBoss/WildFly.
This is the recommended path and you can use it following the original instructions from Keycoak's stock Docker images.
To deploy the extension manually in an existing Keycoak instance, the only requirement
is to copy the compiled file into the
In case you want to disable it, you only need to delete the file from the same folder.
This also works without restarting the instance.
API CRUD actions can be found in Postman's collection.
- Create an authentication token. At the moment only people with
adminrole can do so. In the future, custom configuration of which role is the one to check will be possible. This means that any user with the proper roles can use it, even Service Accounts from Clients. This last case has the benefit of allowing to cancel both API client and account at once, in case this API is used from a remote interface.
# Create a token with user "admin" and pass "admin" curl -X POST \ http://localhost:8080/auth/realms/master/protocol/openid-connect/token \ -H 'accept-language: application/json' \ -H 'cache-control: no-cache' \ -H 'content-type: application/x-www-form-urlencoded' \ -d 'grant_type=password&username=admin&password=admin&client_id=admin-cli'
This returns a JSON containing Access Token, TTL, and Refresh Token. The Access Token can be used to do authenticated calls to the API. The Refresh Token allows to retrieve a new Access Token, as this last one is short lived. A Refresh Token allows you to authenticate again without knowing/having to send again the credentials of the user.
- With the given Access Token, do authenticated calls to the API to do CRUD actions to the clients. For example, to create a client with the currrent user:
The payload should be a client JSON following the model used as well in Keycloak's API: http://www.keycloak.org/docs-api/3.1/rest-api/index.html#_clientrepresentation
None of the parameters is required. In case of the clientId, it will be a randomly generated one, and it will load all the other settings with the default ones.
The returned JSON includes the complete representation of the new client (including the clientId, clientSecret and any other parameter related to the client).
In order for the clients to be available in this API, they need to be created via the API. Clients created through the Admin interface or the Admin API, won't appear available here.
Updating to a new Keycloak version
To update the build to a new Keycloak version, the only task needed to do so is to update the Keycloack version in
pom.xml file in the root, to reflect the new version of Keycloak as dependency.
Afterwards, please, tests that the build compiles and deploys properly as dependencies in Keycloak may change.