#Manage Users and Roles

Keycloak provides comprehensive user lifecycle management and fine-grained role-based access control (RBAC). Users, roles, and groups are managed per Realm.

#User Management

#Create a User

# Obtain an admin access token
ACCESS_TOKEN=$(curl -s -X POST \
  "https://<keycloak-host>/realms/master/protocol/openid-connect/token" \
  -d "client_id=admin-cli" \
  -d "username=<admin-user>" \
  -d "password=<admin-password>" \
  -d "grant_type=password" | jq -r '.access_token')

# Create the user
curl -s -X POST \
  "https://<keycloak-host>/admin/realms/<realm>/users" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username": "jdoe",
    "email": "jdoe@example.com",
    "firstName": "John",
    "lastName": "Doe",
    "enabled": true,
    "emailVerified": true,
    "credentials": [{
      "type": "password",
      "value": "changeme",
      "temporary": true
    }]
  }'

#Reset User Password

1. In the Admin Console, go to Users and select the target user.
2. Click the Credentials tab.
3. Click Reset password.
4. Enter a new password and toggle Temporary if you want the user to change the password on next login.
5. Click Save password.

#Role Management

Keycloak supports two types of roles:

#Create a Realm Role

1. In the Admin Console, go to Realm Roles.
2. Click Create role.
3. Enter a Role name and optional Description.
4. Click Save.

#Assign Roles to Users

1. Go to Users and select the target user.
2. Click the Role mapping tab.
3. Click Assign role.
4. Select the roles to assign and click Assign.

#Group Management

Groups allow you to manage role assignments for multiple users at once. Assign roles to a group, and all group members inherit those roles automatically.

#Create a Group

1. In the Admin Console, go to Groups.
2. Click Create group.
3. Enter a Name and click Create.
4. In the Role Mapping tab of the group, assign the desired Realm or client roles.

#Add Users to a Group

1. Go to Users and select the target user.
2. Click the Groups tab.
3. Click Join Group, select the group, and click Join.

#Composite Roles

A Composite Role is a role that contains other roles. When a user is assigned a composite role, they inherit all roles included in it. This simplifies permission management for complex role hierarchies.

To create a composite role:

1. Create a Realm role.
2. In the role's detail view, enable Composite role.
3. In the Associated roles tab, add the child roles.

#Admin Access Control

Keycloak provides fine-grained control over who can administer realms and what operations they can perform.

#Master Realm vs Realm-Specific Admins

#Fine-Grained Admin Roles

The realm-management client in each realm provides granular admin roles. Roles follow a view-* / manage-* pattern — view-* grants read-only access, manage-* grants full CRUD access and implicitly includes the corresponding view-* permission.

#Permission Boundaries

Fine-grained admin permissions have the following boundaries:

• Delegated admins cannot grant roles they do not have themselves. A user with manage-users but without manage-clients cannot assign client roles.
• Delegated admins cannot access other realms unless they also have roles in those realms.
• The realm-admin composite role includes all individual admin roles. Assign it only when full realm administration is intended.

#Create a Delegated Admin

To create an admin user who can only manage users in a specific realm:

1. Create a user in the target realm.
2. Go to the user's Role mapping tab.
3. Click Assign role > Filter by clients.
4. Search for realm-management.
5. Assign view-users, manage-users, query-users, and query-realms roles.
6. The user can now access the Admin Console at https://<keycloak-host>/admin/<realm>/console with limited permissions.