如何通过 REST 将客户端授权设置导入 Keycloak REALM？

Question

I am trying to import a client and its authorization settings into my current Realm "TestRealm" using the REST API of the Keycloak version 15 via my Python script. My client representation is a JSON dump of another Keycloak REALM of mine, so I know that the values and structure is correct.
Here is a snippet of my code, how I try to import the client and its authorization settings:

class KeycloakClient:
  def __init__(self, base_url, admin_username, admin_password, verify=True):
    self.keycloak_base = base_url
    self.admin_username = admin_username
    self.admin_password = admin_password
    self.current_access_token = None
    self.verify = verify

  @property
  def token(self):
    if not self.current_access_token or self.is_token_expired():
      # implemented elsewhere
      self.refresh_access_token()
    return self.current_access_token

  def post(self, path, data):
    headers = {
      'Authorization': 'Bearer ' + self.token,
      'content-type': 'application/json;charset=UTF-8'
    }
    return requests.post(f"{self.keycloak_base}/{path}", data=data, headers=headers, verify=self.verify)

  def create_client(self, realmName, clientData):
    return self.post(f"admin/realms/{realmName}/clients", data=clientData)
    
keycloak_client = KeycloakClient("127.0.0.1:8080", "admin", "pass!")

client_file = open("single_client.json", "r")
new_client = client_file.read()

keycloak_client.create_client("TestRealm", new_client)

The client representation inside "single_client.json" looks like this:

{
"id" : "586fcea1-9049-47a0-af14-9e09d660a728",
"clientId" : "Test-Client",
"name" : "Test-Client-New",
"surrogateAuthRequired" : false,
"enabled" : true,
"alwaysDisplayInConsole" : false,
"clientAuthenticatorType" : "client-secret",
"secret" : "5123feeb-8754-49bf-b98a-2d5411bb53b",
"authorizationSettings" : {
  "allowRemoteResourceManagement" : true,
  "policyEnforcementMode" : "ENFORCING",
  "resources" : [ {
    "name" : "Dialog.Systeminformation.OS",
    "ownerManagedAccess" : false,
    "displayName" : "System Information OS",
    "attributes" : {
      "Description" : [ "View all OS" ]
    },
    "_id" : "0afa876b-7f22-4ecd-8393-4101dc6dc89e",
    "uris" : [ ],
    "scopes" : [ {
      "name" : "visible"
    } ]
  }, {
    "name" : "View.Data.ViewerClasses",
    "ownerManagedAccess" : false,
    "displayName" : "Data ViewerClasses",
    "attributes" : {
      "Description" : [ "View/edit viwer class data" ]
    },
    "_id" : "0d08ea97-4a61-4b9f-9b97-3bc1c87fe5e4",
    "uris" : [ ],
    "scopes" : [ {
      "name" : "visible"
    }, {
      "name" : "editable"
    } ]
  } ]
}

After executing this script I can see the fully imported client inside the Keycloak UI, with the exception of the authorization settings.

NOTE: The same problem occurs when I try to update an existing clint using the PUT endpoint for clients. I have tried this with different clients but always end up without the authorization settings being imported or updated.

Am I using the API in a wrong way or is this behavior intended? What other ways exist to import client authorization settings separately from the REALM. IF there maybe is a better way to update my realm or if I missed out on an endpoint I would be happy for recommendations.

NOTE 2: The overall goal of the intended import is to update a REALM, but keep user/group/parts of the authorization settings.

Answer 1

You missed one item in yours client.json file.

you needs to add "serviceAccountsEnabled": true,

This JSON works at Keycloak v18.0.0

{
    "id": "586fcea1-9049-47a0-af14-9e09d660a728",
    "clientId": "Test-Client",
    "name": "Test-Client-New",
    "surrogateAuthRequired": false,
    "enabled": true,
    "alwaysDisplayInConsole": false,
    "clientAuthenticatorType": "client-secret",
    "secret": "5123feeb-8754-49bf-b98a-2d5411bb53b",
    "redirectUris": [],
    "webOrigins": [],
    "notBefore": 0,
    "bearerOnly": false,
    "consentRequired": false,
    "standardFlowEnabled": true,
    "implicitFlowEnabled": false,
    "directAccessGrantsEnabled": false,
    "serviceAccountsEnabled": true,
    "publicClient": false,
    "frontchannelLogout": false,
    "protocol": "openid-connect",
    "attributes": {},
    "authenticationFlowBindingOverrides": {},
    "fullScopeAllowed": true,
    "nodeReRegistrationTimeout": -1,
    "authorizationSettings": {
        "allowRemoteResourceManagement": true,
        "policyEnforcementMode": "ENFORCING",
        "resources": [
            {
                "name": "Dialog.Systeminformation.OS",
                "ownerManagedAccess": false,
                "displayName": "System Information OS",
                "attributes": {},
                "uris": [],
                "scopes": [
                    {
                        "name": "visible"
                    }
                ]
            },
            {
                "name": "View.Data.ViewerClasses",
                "ownerManagedAccess": false,
                "displayName": "Data ViewerClasses",
                "attributes": {},
                "uris": [],
                "scopes": [
                    {
                        "name": "visible"
                    },
                    {
                        "name": "editable"
                    }
                ]
            }
        ],
        "scopes": [
            {
                "name": "visible"
            },
            {
                "name": "editable"
            }
        ],
        "decisionStrategy": "UNANIMOUS"
    }
}

This posted screen capture in Postmen after add client POST call.

This is Added Client screen in Keycloak after call API. Keycloak returned 201 Created status without error. You can see added new resources with scopes in client's Authorization tab.