从 Keycloak 导出用户和角色

Question

I created users and roles in Keycloak which I want to export.

When I tried to export them using the realm's "Export" button in UI I got a JSON file downloaded.

But I couldn't find any users or roles in the exported file realm.json

How can I export a realm JSON including users and roles from Keycloak?

Answer 1

You will not be able to do that using the export functionality. However, you can get that information by using Keycloak Admin REST API

The first step is to get an access token from the admin a-like user ( eg, the admin of the master realm), so that you can call the Rest API:

curl    -d "client_id=admin-cli" \
        -d "username=$ADMIN_NAME" \
        -d "password=$ADMIN_PASSWORD" \
        -d "grant_type=password" \
        https://$KEYCLOAK_IP/auth/realms/master/protocol/openid-connect/token

You will get a JSON response with the admin token. Extract the access token from that response (lets called $ACCESS_TOKEN ).

Now you can get the list of users:

curl -X GET https://$KEYCLOAK_IP/auth/admin/realms/$REALM_NAME/users
    -H "Content-Type: application/json" \
    -H "Authorization: bearer $ACCESS_TOKEN"

Now to get the Realm Roles:

curl -X GET https://$KEYCLOAK_IP/auth/admin/realms/$REALM_NAME/roles
    -H "Content-Type: application/json" \
    -H "Authorization: bearer $ACCESS_TOKEN"

Now you just need to save the JSON responses from those endpoint into JSON files.

Answer 2

When following the guide from dreamcrash to export users and roles, you might want to achieve all in one script:

1. export the realm as JSON like done with UI button
2. get and add the users array to this JSON
3. get and add the roles array to this JSON

You can use the command-line tool jq to integrate all 3 JSON parts:

# define the variables: url, credentials to access REST API, and the realm to export
KEYCLOAK_URL="https://localhost:8080"
KEYCLOAK_REALM="master"
KEYCLOAK_USER="admin"
KEYCLOAK_SECRET="secret"
REALM_NAME="myRealm"

# obtain the access token
ACCESS_TOKEN=$(curl -X POST "${KEYCLOAK_URL}/auth/realms/${KEYCLOAK_REALM}/protocol/openid-connect/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=${KEYCLOAK_USER}" \
  -d "password=${KEYCLOAK_SECRET}" \
  -d "grant_type=password" \
  -d 'client_id=admin-cli' \
  | jq -r '.access_token')

# export the realm as JSON
curl -X GET "${KEYCLOAK_URL}/auth/admin/realms/${REALM_NAME}"
  -H "Accept: application/json" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  > keycloak_${REALM_NAME}_realm.json

# export the users
curl -X GET "${KEYCLOAK_URL}/auth/admin/realms/${REALM_NAME}/users" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  > keycloak_${REALM_NAME}_users.json

# export the roles
curl -X GET "${KEYCLOAK_URL}/auth/admin/realms/${REALM_NAME}/roles" \
  -H "Accept: application/json" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  > keycloak_${REALM_NAME}_roles.json

# integrate all 3 using jq's slurp
jq -s '.[0] + {users:.[1], roles:.[2]}' \
  keycloak_${REALM_NAME}_realm.json \ 
  keycloak_${REALM_NAME}_users.json \
  keycloak_${REALM_NAME}_roles.json \
  > keycloak_${REALM_NAME}_realm-incl-users-roles.json

The resulting file keycloak_${REALM_NAME}_realm-incl-users-roles.json may then look like this simplified example:

{
  "realm": "master",
  "users": [
    {
      "id": "user1"
    },
    {
      "id": "user2"
    }
  ],
  "roles": [
    {
      "id": "role1"
    },
    {
      "id": "role2"
    }
  ]
}

Answer 3

Using Keycloak standalone:

bin\kc.bat export --file realm_export.json --realm test_realm --users realm_file

as described in the documentation here https://www.keycloak.org/server/importExport