Add keycloak project: realm import, resource server with realm and client role mapping, audience and issuer traps, method security, admin client

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01VRLbHYdXVEBzGVhYq3pz4q
2026-10-17 15:50:36 +00:00
parent f6dd692177
commit 6b09fe7b82
21 changed files with 919 additions and 2 deletions
@@ -0,0 +1,92 @@
+{
+  "realm": "demo",
+  "enabled": true,
+  "sslRequired": "none",
+  "registrationAllowed": false,
+  "roles": {
+    "realm": [
+      { "name": "user", "description": "Can read reports" },
+      { "name": "admin", "description": "Can manage users through the admin API" }
+    ],
+    "client": {
+      "spring-api": [
+        { "name": "reports-write", "description": "Client role: can export reports" }
+      ]
+    }
+  },
+  "clients": [
+    {
+      "clientId": "spring-api",
+      "name": "Spring resource server",
+      "enabled": true,
+      "bearerOnly": true
+    },
+    {
+      "clientId": "demo-cli",
+      "name": "Public client WITHOUT an audience mapper",
+      "enabled": true,
+      "publicClient": true,
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": true
+    },
+    {
+      "clientId": "demo-cli-aud",
+      "name": "Public client WITH an audience mapper for spring-api",
+      "enabled": true,
+      "publicClient": true,
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": true,
+      "protocolMappers": [
+        {
+          "name": "spring-api-audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "config": {
+            "included.client.audience": "spring-api",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
+        }
+      ]
+    },
+    {
+      "clientId": "admin-svc",
+      "name": "Service account used by the admin client",
+      "enabled": true,
+      "publicClient": false,
+      "secret": "admin-svc-demo-secret",
+      "standardFlowEnabled": false,
+      "directAccessGrantsEnabled": false,
+      "serviceAccountsEnabled": true
+    }
+  ],
+  "users": [
+    {
+      "username": "alice",
+      "enabled": true,
+      "email": "[email protected]",
+      "emailVerified": true,
+      "firstName": "Alice",
+      "lastName": "Anderson",
+      "credentials": [ { "type": "password", "value": "password", "temporary": false } ],
+      "realmRoles": [ "user" ]
+    },
+    {
+      "username": "bob",
+      "enabled": true,
+      "email": "[email protected]",
+      "emailVerified": true,
+      "firstName": "Bob",
+      "lastName": "Brown",
+      "credentials": [ { "type": "password", "value": "password", "temporary": false } ],
+      "realmRoles": [ "user", "admin" ],
+      "clientRoles": { "spring-api": [ "reports-write" ] }
+    },
+    {
+      "username": "service-account-admin-svc",
+      "enabled": true,
+      "serviceAccountClientId": "admin-svc",
+      "clientRoles": { "realm-management": [ "manage-users", "view-users", "view-realm" ] }
+    }
+  ]
+}