Admin API: filter users by group #19802

luciano-fiandesio · 2023-04-19T10:28:55Z

luciano-fiandesio
Apr 19, 2023

Hello, I'm using the /admin APIs to fetch and manage users for a Realm.

I'm using Polices to allow specific users to access the /users endpoint.

Now, I would like to filter the users returning from the API by group: to be precise, the filter should match the user executing the request's group with the users' group. If the caller belongs to group group-1, only users belonging to group-1 should return from the /admin/realms/[realm]/users endpoint.

I thought that I could use a Policy for the filtering (since policies should support ABAC), but I could not find a good example - my understanding is that for these kinds of use cases, I should use a JS policy, but it is not clear to me how these are created.

What would be the correct approach to achieve user filtering at the admin API level?

Thanks!

Version: keycloak-21.0.1 with --features=admin-fine-grained-authz flag

slominskir · 2023-05-24T20:33:51Z

slominskir
May 24, 2023

With the provided Java Admin API you'd use the GroupResource. I've used the similar RoleResource before and usage looks something like:

    private final Keycloak keycloak;
    private final String realm;
    private final String resource;
    private final String secret;

    {
        String keycloakServerUrl = System.getenv("KEYCLOAK_BACKEND_SERVER_URL");
        realm = System.getenv("KEYCLOAK_REALM");
        resource = System.getenv("KEYCLOAK_RESOURCE");
        secret = System.getenv("KEYCLOAK_SECRET");

        keycloak = KeycloakBuilder.builder()
                .serverUrl(keycloakServerUrl)
                .realm(realm)
                .grantType(OAuth2Constants.CLIENT_CREDENTIALS)
                .clientId(resource)
                .clientSecret(secret)
                .build();
    }

    private Set<UserRepresentation> lookupUsersInRole(String role) {

        Set<UserRepresentation> users = null;

        RolesResource roles = keycloak.realm(realm).roles();

        try {
            RoleResource roleResource = roles.get(role);

            users = roleResource.getRoleUserMembers();

        } catch (NotFoundException e) {
            LOGGER.log(Level.INFO, "Role not found in Keycloak: " + role);
        }

        return users;
    }

If you ultimately do not want to use the Java Admin API, you can probably watch the HTTP requests it makes to determine how to manually construct a REST query, or refer to the docs, which indicate the format is:

GET /{realm}/groups/{id}/members

0 replies

Navigation Menu

Repository navigation

Admin API: filter users by group #19802

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Admin API: filter users by group #19802

Uh oh!

Uh oh!

luciano-fiandesio Apr 19, 2023

Replies: 1 comment

Uh oh!

slominskir May 24, 2023

luciano-fiandesio
Apr 19, 2023

slominskir
May 24, 2023