错误403从Keycloak访问管理员/组OIDC API

Question

仅使用keycloak-authz-client（6.0.1）（无Spring Security），我需要从服务提供商处读取用户信息和用户组。

获得正确的访问令牌后，感谢AuthzClient，我能够获得用户信息API：

    UriBuilder target = UriBuilder.fromUri(kcURL);
    target.path("realms/{realm}/protocol/openid-connect/userinfo")
          .resolveTemplate("realm", this.realm);

    UserInfoOIDC info = new UserInfoOIDC();
    try {
        UserInfo response = this.buildBearerInvocation(target, accessToken).get(UserInfo.class);
        info.setName(response.getName());
        info.setUsername(response.getPreferredUsername());
        info.setCompleted(true);
        log.info("User info successfully retrieved from {}", this.realm);
    } catch (WebApplicationException e) {
        log.error("User info failure on {}: {}", this.realm, e.getMessage());
    }
...
    private Invocation.Builder buildBearerInvocation(UriBuilder target, String accessToken) {
        WebTarget webTarget = restClient.target(target);
        Invocation.Builder builder = webTarget.request(APPLICATION_JSON)
                .header(AUTHORIZATION, "Bearer " + accessToken);
        return builder;
    }

但我无法访问“管理员API”：

    UriBuilder target = UriBuilder.fromUri(kcURL);
    target.path("admin/realms/" + this.realm);
    target.path("users/" + userId);
    target.path("groups");
    try {
        return this.buildBearerInvocation(target, accessToken)
                .get(GroupRepresentation.class);
    } catch (WebApplicationException e) {
        log.error("User groups failure on realms {}: {}", this.realm, e.getMessage());
    }

[main] INFO com.LoggingFilter - 处理http：// localhost：8080 / auth / admin / realms / TestRealm / users / 0f443554-01d0-4b40-a652-0c8c174632d4 / groups [main] ERROR com.KeycloakProvider - 用户组失败领域TestRealm：HTTP 403 Forbidden

我想知道这可能只是来自用户访问权限不足或者来自CORS问题（我已经将“127.0.0.1 localhost-auth”添加到我的etc / hosts文件中，完全不确定虽然这里有帮助。 如何为用户打开“admin API”，为用户打开更多CORS配置或任何特殊角色？

编辑 - Keycloak管理客户端在这里没有帮助（HTTP 403 Forbidden也是如此）：

    @Test
    public void checkKeycloakAdminClient() {
        Keycloak client = KeycloakBuilder.builder()
                .serverUrl(url)
                .realm(realm)
                .username(adminUsername)
                .password(adminPassword)
                .clientId(clientId)
                .clientSecret(clientSecret)
                .build();
        RealmResource realmResource = client.realm(realm);

        UsersResource usersResource = realmResource.users();
        List<UserRepresentation> users = usersResource.search(username);
    }

Answer 1

将所有“view -...”和“query -...”可用的客户端角色从“领域管理”领域的客户端分配给管理员用户（请参阅用户/角色映射）。