Client
data class ClientServiceAccountRealmRoleArgs(val realmId: Output<String>? = null, val role: Output<String>? = null, val serviceAccountUserId: Output<String>? = null) : ConvertibleToJava<ClientServiceAccountRealmRoleArgs>
Allows for assigning realm roles to the service account of an openid client. You need to set service_accounts_enabled to true for the openid client that should be assigned the role. If you'd like to attach client roles to a service account, please use the keycloak.openid.ClientServiceAccountRole resource.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";
const realm = new keycloak.Realm("realm", {
realm: "my-realm",
enabled: true,
});
const realmRole = new keycloak.Role("realm_role", {
realmId: realm.id,
name: "my-realm-role",
});
const client = new keycloak.openid.Client("client", {
realmId: realm.id,
name: "client",
serviceAccountsEnabled: true,
});
const clientServiceAccountRole = new keycloak.openid.ClientServiceAccountRealmRole("client_service_account_role", {
realmId: realm.id,
serviceAccountUserId: client.serviceAccountUserId,
role: realmRole.name,
});Content copied to clipboard
import pulumi
import pulumi_keycloak as keycloak
realm = keycloak.Realm("realm",
realm="my-realm",
enabled=True)
realm_role = keycloak.Role("realm_role",
realm_id=realm.id,
name="my-realm-role")
client = keycloak.openid.Client("client",
realm_id=realm.id,
name="client",
service_accounts_enabled=True)
client_service_account_role = keycloak.openid.ClientServiceAccountRealmRole("client_service_account_role",
realm_id=realm.id,
service_account_user_id=client.service_account_user_id,
role=realm_role.name)Content copied to clipboard
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;
return await Deployment.RunAsync(() =>
{
var realm = new Keycloak.Realm("realm", new()
{
RealmName = "my-realm",
Enabled = true,
});
var realmRole = new Keycloak.Role("realm_role", new()
{
RealmId = realm.Id,
Name = "my-realm-role",
});
var client = new Keycloak.OpenId.Client("client", new()
{
RealmId = realm.Id,
Name = "client",
ServiceAccountsEnabled = true,
});
var clientServiceAccountRole = new Keycloak.OpenId.ClientServiceAccountRealmRole("client_service_account_role", new()
{
RealmId = realm.Id,
ServiceAccountUserId = client.ServiceAccountUserId,
Role = realmRole.Name,
});
});Content copied to clipboard
package main
import (
"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
Realm: pulumi.String("my-realm"),
Enabled: pulumi.Bool(true),
})
if err != nil {
return err
}
realmRole, err := keycloak.NewRole(ctx, "realm_role", &keycloak.RoleArgs{
RealmId: realm.ID(),
Name: pulumi.String("my-realm-role"),
})
if err != nil {
return err
}
client, err := openid.NewClient(ctx, "client", &openid.ClientArgs{
RealmId: realm.ID(),
Name: pulumi.String("client"),
ServiceAccountsEnabled: pulumi.Bool(true),
})
if err != nil {
return err
}
_, err = openid.NewClientServiceAccountRealmRole(ctx, "client_service_account_role", &openid.ClientServiceAccountRealmRoleArgs{
RealmId: realm.ID(),
ServiceAccountUserId: client.ServiceAccountUserId,
Role: realmRole.Name,
})
if err != nil {
return err
}
return nil
})
}Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.Role;
import com.pulumi.keycloak.RoleArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.openid.ClientServiceAccountRealmRole;
import com.pulumi.keycloak.openid.ClientServiceAccountRealmRoleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var realm = new Realm("realm", RealmArgs.builder()
.realm("my-realm")
.enabled(true)
.build());
var realmRole = new Role("realmRole", RoleArgs.builder()
.realmId(realm.id())
.name("my-realm-role")
.build());
var client = new Client("client", ClientArgs.builder()
.realmId(realm.id())
.name("client")
.serviceAccountsEnabled(true)
.build());
var clientServiceAccountRole = new ClientServiceAccountRealmRole("clientServiceAccountRole", ClientServiceAccountRealmRoleArgs.builder()
.realmId(realm.id())
.serviceAccountUserId(client.serviceAccountUserId())
.role(realmRole.name())
.build());
}
}Content copied to clipboard
resources:
realm:
type: keycloak:Realm
properties:
realm: my-realm
enabled: true
realmRole:
type: keycloak:Role
name: realm_role
properties:
realmId: ${realm.id}
name: my-realm-role
client:
type: keycloak:openid:Client
properties:
realmId: ${realm.id}
name: client
serviceAccountsEnabled: true
clientServiceAccountRole:
type: keycloak:openid:ClientServiceAccountRealmRole
name: client_service_account_role
properties:
realmId: ${realm.id}
serviceAccountUserId: ${client.serviceAccountUserId}
role: ${realmRole.name}Content copied to clipboard
Import
This resource can be imported using the format {{realmId}}/{{serviceAccountUserId}}/{{roleId}}. Example: bash
$ pulumi import keycloak:openid/clientServiceAccountRealmRole:ClientServiceAccountRealmRole client_service_account_role my-realm/489ba513-1ceb-49ba-ae0b-1ab1f5099ebf/c7230ab7-8e4e-4135-995d-e81b50696ad8Content copied to clipboard