使用 keycloak 管理客户端以编程方式为具有访问类型 public 的客户端创建用户

Question

I have just started using keycloak and seems to have hit a hurdle. I am not able to create a user programmatically using the keycloak-admin-client for java. My keycloak server version is 8.0.0 and the library/jar version is also same. When I try to create a user my program just sits there keep waiting where as in logs i can see login error

2019-12-03 20:10:19,842 WARN  [org.keycloak.events] (default task-26) type=LOGIN_ERROR, realmId=root-admin, clientId=demo-app, userId=null, ipAddress=192.x.x.x, error=not_allowed, auth_method=oauth_credentials, grant_type=password, client_auth_method=client-secret


Keycloak keycloak = KeycloakBuilder.builder() //
                .serverUrl("http://192.x.x.x:8080/auth") //
                .realm("root-admin") //
                .grantType(OAuth2Constants.PASSWORD) //
                .clientId("demo-app")
                .clientSecret("")////
                .username("genghis khan") //
                .password("1234") //
                .build();
        CredentialRepresentation credential = new CredentialRepresentation();
        credential.setType(CredentialRepresentation.PASSWORD);
        credential.setValue("12345678");
        UserRepresentation user = new UserRepresentation();
        user.setEnabled(true);
        user.setUsername("michaeljackson");
        user.setFirstName("michael");
        user.setLastName("jackson");
        user.setCredentials(Arrays.asList(credential));

        Response resp=keycloak.realm("root-admin").users().create(user);
        System.out.println(resp.getStatus());

My client is a public facing app so it has access type set as public and therefore no client secret is generated for it, also genghis khan user has role as admin and root-admin realm has been created by me. Need help as to how to make this work

Answer 1

Try enabling "Direct Access Grants Enabled" of demo-app client on the admin console.

.grantType(OAuth2Constants.PASSWORD) //

This line means you're using "Resource Owner Password Credentials Grant", and it needs to be enabled.

See also: https://www.keycloak.org/docs/8.0/server_admin/index.html#oidc-clients