How to give a client the possibility to get the list of users?

[flixman]

I have a client with a service role, and I have given it all the roles of the realm-management client. Still, when I execute this curl

curl -sk https://keycloak.local:8443/admin/realms/<realm>/users -d grant_type=client_credentials -d client_id=<client_id> -d client_secret=<client_secret>

I get "Unauthorized access". What am I doing wrong?

[codespearhead]

I'm not sure I understand your question.

Are you struggling to authenticate against the Keycloak Admin REST API?

If so, see this answer from #29090 .

[codespearhead]

Does the suggested script in that discussion answer your question?

[flixman]

no, because I can successfully authenticate using the admin-cli client. What I need is to have a test client with this specific permission to query users, and I do not know what roles it requires.

[codespearhead]

Try assigning the view-users role to that confidential client (Keycloak client with client authentication and authorization fields turned on) of yours.

[flixman]

This is what I have, already:

It's because of this, that I do not know what is wrong.

[flixman]

I do not understand what I am doing wrong with curl. However, with python (using authlib, OAuth2Client) I can use that test client as expected (after fetching the token and so). Thank you very much for your help, anyway, @codespearhead !