pulumi-keycloak-kotlin/com.pulumi.keycloak.openid.kotlin/ClientServiceAccountRealmRole

ClientServiceAccountRealmRole

class ClientServiceAccountRealmRole : KotlinCustomResource

Allows for assigning realm roles to the service account of an openid client. You need to set service_accounts_enabled to true for the openid client that should be assigned the role. If you'd like to attach client roles to a service account, please use the keycloak.openid.ClientServiceAccountRole resource.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";
const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const realmRole = new keycloak.Role("realm_role", {
    realmId: realm.id,
    name: "my-realm-role",
});
const client = new keycloak.openid.Client("client", {
    realmId: realm.id,
    name: "client",
    serviceAccountsEnabled: true,
});
const clientServiceAccountRole = new keycloak.openid.ClientServiceAccountRealmRole("client_service_account_role", {
    realmId: realm.id,
    serviceAccountUserId: client.serviceAccountUserId,
    role: realmRole.name,
});

import pulumi
import pulumi_keycloak as keycloak
realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
realm_role = keycloak.Role("realm_role",
    realm_id=realm.id,
    name="my-realm-role")
client = keycloak.openid.Client("client",
    realm_id=realm.id,
    name="client",
    service_accounts_enabled=True)
client_service_account_role = keycloak.openid.ClientServiceAccountRealmRole("client_service_account_role",
    realm_id=realm.id,
    service_account_user_id=client.service_account_user_id,
    role=realm_role.name)

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;
return await Deployment.RunAsync(() =>
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });
    var realmRole = new Keycloak.Role("realm_role", new()
    {
        RealmId = realm.Id,
        Name = "my-realm-role",
    });
    var client = new Keycloak.OpenId.Client("client", new()
    {
        RealmId = realm.Id,
        Name = "client",
        ServiceAccountsEnabled = true,
    });
    var clientServiceAccountRole = new Keycloak.OpenId.ClientServiceAccountRealmRole("client_service_account_role", new()
    {
        RealmId = realm.Id,
        ServiceAccountUserId = client.ServiceAccountUserId,
        Role = realmRole.Name,
    });
});

package main
import (
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v5/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		realmRole, err := keycloak.NewRole(ctx, "realm_role", &keycloak.RoleArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("my-realm-role"),
		})
		if err != nil {
			return err
		}
		client, err := openid.NewClient(ctx, "client", &openid.ClientArgs{
			RealmId:                realm.ID(),
			Name:                   pulumi.String("client"),
			ServiceAccountsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		_, err = openid.NewClientServiceAccountRealmRole(ctx, "client_service_account_role", &openid.ClientServiceAccountRealmRoleArgs{
			RealmId:              realm.ID(),
			ServiceAccountUserId: client.ServiceAccountUserId,
			Role:                 realmRole.Name,
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.Role;
import com.pulumi.keycloak.RoleArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.openid.ClientServiceAccountRealmRole;
import com.pulumi.keycloak.openid.ClientServiceAccountRealmRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .build());
        var realmRole = new Role("realmRole", RoleArgs.builder()
            .realmId(realm.id())
            .name("my-realm-role")
            .build());
        var client = new Client("client", ClientArgs.builder()
            .realmId(realm.id())
            .name("client")
            .serviceAccountsEnabled(true)
            .build());
        var clientServiceAccountRole = new ClientServiceAccountRealmRole("clientServiceAccountRole", ClientServiceAccountRealmRoleArgs.builder()
            .realmId(realm.id())
            .serviceAccountUserId(client.serviceAccountUserId())
            .role(realmRole.name())
            .build());
    }
}

resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  realmRole:
    type: keycloak:Role
    name: realm_role
    properties:
      realmId: ${realm.id}
      name: my-realm-role
  client:
    type: keycloak:openid:Client
    properties:
      realmId: ${realm.id}
      name: client
      serviceAccountsEnabled: true
  clientServiceAccountRole:
    type: keycloak:openid:ClientServiceAccountRealmRole
    name: client_service_account_role
    properties:
      realmId: ${realm.id}
      serviceAccountUserId: ${client.serviceAccountUserId}
      role: ${realmRole.name}

Import

This resource can be imported using the format {{realmId}}/{{serviceAccountUserId}}/{{roleId}}. Example: bash

$ pulumi import keycloak:openid/clientServiceAccountRealmRole:ClientServiceAccountRealmRole client_service_account_role my-realm/489ba513-1ceb-49ba-ae0b-1ab1f5099ebf/c7230ab7-8e4e-4135-995d-e81b50696ad8