30

How do I create an admin user in a realm in Keycloak? I tried /bin/add-user.sh -r myrealm -u admin -p <pwd> It gave me the error:


 * Error *
WFLYDM0065: The user supplied realm name 'myrealm' does not match the realm name discovered from the property file(s) 'ManagementRealm'.

Exception in thread "main" org.jboss.as.domain.management.security.adduser.AddUserFailedException: WFLYDM0065: The user supplied realm name 'myrealm' does not match the realm name discovered from the property file(s) 'ManagementRealm'.
    at org.jboss.as.domain.management.security.adduser.ErrorState.execute(ErrorState.java:72)
    at org.jboss.as.domain.management.security.adduser.AddUser.run(AddUser.java:133)
    at org.jboss.as.domain.management.security.adduser.AddUser.main(AddUser.java:231)
    at org.jboss.modules.Module.run(Module.java:352)
    at org.jboss.modules.Module.run(Module.java:320)
    at org.jboss.modules.Main.main(Main.java:593)

I tried /bin/add-user-keycloak.sh -r myrealm -u admin -p <pwd>. It asked me to restart the server which I did but I did not see the user either.

If one knows how to make it using the python client, that would be great too.

RAbraham
  • 5,956
  • 8
  • 45
  • 80

5 Answers5

78
  1. Create regular user in a realm:
    1. Open admin console and select realm of your choice (realm selection box on top left side).
    2. Go to users (sidebar) -> add user (button on the right side)
    3. Fill in required fields and press save button.
    4. Open Credentials tab and set password.
    5. Open Role Mapping tab:
      1. Select realm-management under Client Roles.
      2. Select all available roles and press Add selected. (realm-admin is enough, other roles are inherited. Effective Roles will show the role mapping for the client)
  2. Go to http://keycloak/auth/admin/REALM_NAME/console (replace REALM_NAME with realm name in which you created the user) and login.
  3. You should see admin UI only for this realm.

You can also automate user creation via Admin REST API: https://www.keycloak.org/docs-api/21.0.0/rest-api/index.html

Vadim Ashikhman
  • 9,851
  • 1
  • 35
  • 39
14

Fromyour example, i suppose you want to create an admin that would administrate a new realm. Then an admin form this new realm, different from the master (default) one.

Simply, here is the way to create an admin in a realm.

1 - Create the realm

  • From the Master realm, create un new realm (Myrealm)
  • Be sure to be in that new realm (select it in the list under master realm)

2 - Create an admin role for the new created realm

  • In the menu (to the left side), under Configure main title, select Roles
  • In the Realm Roles tab, click on the button Add Role and give it a name (admin) and a description (Myrealm admin role) and switch on the Composite Role
  • In the new revealed section (Composite Roles), type in the client roles field: realm-management, then select it.
  • Select all the available elements in that selection from Available Roles, click [Add selected] button.

/!\ This role is only availbale to this realm and will affect only users related to the realm.

3 - Affect the admin role to a user

  • Still in the same realm, create or choose a user you want it to become the admin
  • Go to its Role Mappings tab, and send the Available Roles admin to Assigned Roles.

Try to login http://keycloak/auth/admin/REALM_NAME/console (replace REALM_NAME with realm name in which you created the user) and adjust permissions of this realm admin user (from another browser with the master admin account). For example, the new admin realm user can delete role (that is not normal), it can do many thing on their realm you don't want it to do explicitely... (I guess)

That's all.

Spartacvs1
  • 211
  • 3
  • 5
  • After all the settings and visiting the link http://localhost:8080/auth/admin1/Myrealm/console "We are sorry... Page not found" – ka3ak Dec 15 '21 at 09:34
  • @ka3ak, I see that you have `[url]/admin1/` instead of `admin`. Also, you have to check reverse proxy according to your apache or nginx... There will be also an option `PROXY_ADDRESS_FORWARDING` that will need you to set it to `true`... – Spartacvs1 Dec 19 '21 at 00:32
  • Yes, I've created admin1 instead of admin. It was on purpose – ka3ak Dec 20 '21 at 07:23
  • 4
    Keycloak has changed this workflow a bit. There's no "Composite Role" checkbox now; it's inferred by the roles you've assigned to the role. Also, when I click "Assign Roles", it initially only shows the realm roles and not the client roles. I had to open the Filter and select "Filter by clients" to see the management roles. – carlin.scott Dec 23 '22 at 20:12
  • 2
    @carlin.scott Thanks for your comment, helped a lot. The URL also changed to `http://keycloak/admin/REALM_NAME/console` (without `/auth`). – Alexander Groß Jan 23 '23 at 18:48
10

You should be able to create using add-user-keycloak command , but you need to restart the keycloak server to actually add the user. here is the documentation 

/bin/add-user-keycloak.sh -r myrealm -u admin -p <password>

But before adding user you need to create realm myrealm using 

  kcadm.sh create realms ........
ravthiru
  • 8,878
  • 2
  • 43
  • 52
  • @ravithru. Can you show me the command to restart the server? I tried restarting with `$ ./jboss-cli.sh --connect command=:reload` but it did not work. Though I'm on kubernetes which may complicate the situation. – RAbraham Jun 25 '19 at 14:19
  • we did all setup as part of init script, which starts keycloak, creates needed user, and realm and then restart the keycloak. not sure if any thing available we use kill here. – ravthiru Jul 03 '19 at 04:18
9

Pleas have a look in this command 

/bin/add-user.sh -r myrealm -u admin -p <pwd>

here you are trying to run a shell script which will create a user admin with some password under realm myrealm .

So its mandatory myrealm realm should exist before you are going to create a user under it.

If this is not working try to create a user under master realm which is default realm exist after keycloak installation.

Id you are not aware how to create realm ,here are some of the admin-cli and curl commands to do so

How to create realm with the help of admin-cli

/opt/keycloak/bin/kcadm.sh create realms -s realm=<Realm-NAME> -s id="<realm-id>" -s enabled=true -s

How to create realm with the help of curl command

curl -v <Keycloak-Ip-address>:<Port>/auth/admin/realms -H "Content-Type: application/json" -H "Authorization: Bearer $TOKEN" --data  '{"realm":"Realm-name","id":"Realm-id","enabled":"true"}' -k
Subodh Joshi
  • 12,717
  • 29
  • 108
  • 202
  • 1
    I had already created myrealm previously by logging on to the master UI which my kubernetes script created an admin/password for. But since I created myrealm on my own, I can't seem to create an admin user for it. – RAbraham Jun 25 '19 at 14:23
  • 1
    We are also doing same ,creating realm and then user ,never faced such issue ,try to create same via admin-cli or curl or UI see u r facing same issue ? – Subodh Joshi Jun 25 '19 at 14:30
  • 1
    Thanks for your quick reply! Which one do you use to create admins? `add-user` or `add-user-keycloak`? Also, do you restart your server after? If so, how do you do that? I have already created the realm using the UI and it works. I'm able to add normal users in myrealm, just not admin user. – RAbraham Jun 25 '19 at 15:42
  • We are using admin-cli to create user,realm,group etc and now we moved to Docker container so moved from admin-cli to curl command now. – Subodh Joshi Jun 26 '19 at 01:45
  • @RAbraham Did you figure out a way to restart reliably ? – Sankar Oct 05 '19 at 07:37
  • What do you mean restart realiably – Subodh Joshi Oct 05 '19 at 07:44
  • @SubodhJoshi I am deploying keycloak as a pod. I was looking for a better way than deleting the pod. – Sankar Oct 05 '19 at 08:07
  • Sorry no idea about it. – Subodh Joshi Oct 05 '19 at 08:21
  • 1
    @Sankar. No I couldn't. – RAbraham Oct 06 '19 at 09:29
0

I found this in detail answer here. Since the UI changed a bit over time, this helped me find the settings. I'll paste it here, see the link above for the original thread.

Hi Carl, Thanks, even if your answer was a bit on the cryptic side. So this post just to clarify for others in the same position:

Everything must be done as superadmin in the target realm:

  1. In the navigation panel select “Users”
  2. Click the user you want as local admin
  3. Select Tab “Role Mapping”
  4. Click “Assign Role”
  5. Here comes the tricky part. I believed that the “Filter by realm roles” was a filter to narrow the selection, but it is actually a drop-down menu. Click it and select “Filter by clients”.
  6. Select the “realm-admin” with tag “realm-management”

So thanks again Carl. Obviously you know your way around Keycloak, but some of us are just getting there. But knowing that the option was in fact available was the kicker.

m1212e
  • 303
  • 4
  • 8