在 Keycloak Spring boot 中从另一个领域获取用户列表

Question

I have two realms in Keycloak "internal" and "external".

As a user (not Admin!) from "internal" realm I would like to get list of users from "external" realm.

There is default Role "view_users" but I guess it's only for the users from the same realm right ?

is it possible as not admin user to access to another realm ?

how it would look like in java Spring Boot ?

Answer 1

This is not possible in Keycloak by design, realms are isolated from each other. The exception to this rule is the master realm. A user that is in the master and has the global admin role is allowed to do everything in all realms.

In addition, there are (automatically generated) management clients for all realms in the master realm, in your case named internal-realm and external-realm . These clients, in turn, have a list of client-roles that allow the user that is in those roles, to perform specific actions. You can read more about this in the Keycloak documentation here .