rdf-pub needs access to to Keycloak users. Therefore we use a Service Account. In the following manual, you see, how to setup a client with service account.

How to

Create client

  • Logint to your keycloak Admin Console and open your realm.

  • Choose 'Clients' in thme menue on the left.

  • Click on 'Create' on the upper right.

  • give your client a name. E.g. rdf-pub and save the dialog.

  • adjust the 'Access Type' to confidential

  • switch on 'Service Accounts Enabled'

  • configure a 'Valid Redirect URIs' e.g. http://localhost:8080 if you are testing a local rdf-pub instance.

  • Click on the 'save' Button on the bottom of the form

  • go to the tab 'Credentials', there you can copy the 'Secret' key.

  • go to the tab 'Service Account Roles'

  • select 'realm-management' in the 'Client Roles' drop down.

  • Choose 'Available Role' → 'view-users'

  • Click on 'Add selected' Button


View after you clicked on 'Add selected':


Test with postman

  • create new GET request in postman: http(s)://<host>:<port>/auth/admin/realms/<yourRealm>/users

  • Grant Type: Client Credentials

  • Access Token URL: http(s)://<host>:<port>/auth/realms/<yourRealm>/protocol/openid-connect/token

  • Client ID: 'rdf-pub' or any other name, you choosed while creating a client. See above

  • Client Secret: copy of the Secret in the tab 'Credentials'. See above

  • Click on 'Get New Access Token'

  • Click on 'Proceed' or wait a few seconds until the 'Get new access token dialog' is closing

  • Click on "Use Token"

  • Now postman added the requested token into the access token header.

  • after the token is expired, you have to redo the 'Get New Access Token' procedure.

  • Click on 'Send'

  • if you are a Lucky one, you hav now a list of usres iin the postman response window.


Test with Java

With a simple Unit Test you should also be able to access the users:

import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
import org.junit.jupiter.api.Test;
import org.keycloak.OAuth2Constants;
import org.keycloak.admin.client.Keycloak;
import org.keycloak.admin.client.KeycloakBuilder;
import org.keycloak.admin.client.resource.UsersResource;

class TestKeycloakAccess {

        void test() {
                Keycloak keycloak = KeycloakBuilder.builder()
                                new ResteasyClientBuilder()

                UsersResource ur = keycloak.realm("LOA").users();
                ur.list().forEach(u->System.out.println(u.getUsername() + " - " + u.getEmail()));