如何让所有可以访问特定资源的keycloak用户

Question

I have a KC instance where I have some clients with the Authorization option enabled. All works well, but, acting as a client, I need this specific information: Given a certain resource with specific scopes I want the list of users who have accesse to this resource.

I've explored the available APIs multiple times without success. Is there a way to obtain this information or do I necessary need to extends KC capabilities with a dedicated SPI?

Answer 1

Unfortunately, you cannot. Keycloak authorization mechanism examines only when it has input. Here your input is User. To do that, you have to ask for all users. This is not practical bcz there might be thousand of users.

Resource servers (applications or services serving protected resources) usually rely on some kind of information to decide if access should be granted to a protected resource. For RESTful-based resource servers, that information is usually obtained from a security token, usually sent as a bearer token on every request to the server. For web applications that rely on a session to authenticate users, that information is usually stored in a user's session and retrieved from there for each request

Answer 2

It is possible by Admin rest-API for finding a specific resource's all of user.

This steps

I am using Keycloak v18.0.2 (if use v19/v20, just remove auth in API endpoint)

#1 Get specific client uuid

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}

#2 Get specific resource uuid

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/resource/{resource-uuid}

#3 Get specific permission of #2

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/resource/{resource-uuid}/permissions

#4 Get policy of #3 Get policy and permission list

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/policy

Get policy of specific permission

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/policy/{permission-uuid}/associatedPolicies

#5 Get user list of #4

GET {keycloak_url}/auth/admin/realms/{realm}/clients/{client-uuid}/authz/resource-server/policy/{policy-uuid}

The user list will return in body of response

{
    "id": {policy-uuid},
    "name": {policy-name},
    "config": {
        "users": "[array of {user-uuid}]"
    }
}

Demo by UI

I will find all of user in resource1 of my-test client.

It assosicated permission1

permissions1 apply policy1

policy 's user two users

Demo by API

Same step by APIs

Find client uuid

Find a specific resource uuid

Get specific resource

Get permission and policy list

Get associated policy for permission

Get user list for policy

That user uuid matched user list

So you can find resource1 's user are user1 and user3