Add custom attribute in my keycloak client roles

Question

I can add a custom attribute to my user following this link. I want to add a (common) custom attribute to my client roles. Is it possible? I tried to replicate the custom attribute like my user without success. Could you help me?

Answer 1

You can use this API

Set the custom attributes of client's role

PUT [Keycloak URL](/auth)/admin/realms/[realm name]/roles-by-id/[role UUID]

Body

{
    "name": [Role Name],
    "composite": false,
    "clientRole": true,
    "containerId": [client UUID],
    "attributes": {
        "key 1": [
            "value 1"
        ],
        "key 2": [
            "value 2"
        ]
    }
}

Get the custom attributes of client's role

GET [Keycloak URL](/auth)/admin/realms/[realm name]/client/[client UUID]/[role name]

Keycloak UI

Finally, you can get user's mapping client role

GET [KEYCLOAK URL](/auth)/admin/realms/[realm name]/users/[user UUID]/role-mappings/clients/[Client UUID]

How to get Client's Role ID

GET [Keycloak URL](/auth)/admin/realms/[realm name]/clients/[client UUID]/roles

You can confirm by those curl commands

#1 Set {credential, client name, realm name}

MASTER_USERNAME=admin \
MASTER_PASSWORD=admin \
REALM_NAME=my-realm \
CLIENT_NAME=my-client \
CLIENT_ROLE_NAME=client-role \
USER_NAME=user1

echo '$MASTER_USERNAME = '$MASTER_USERNAME \
echo 'MASTER_PASSWORD = '$MASTER_PASSWORD \
echo 'REALM_NAME = '$REALM_NAME \
echo 'CLIENT_NAME= '$CLIENT_NAME

#2 Get Master Token

MASTER_TOKEN_URL=$(curl --silent --location --request GET 'http://localhost:8080/auth/realms/master/.well-known/openid-configuration' | jq -r '.token_endpoint')
echo $MASTER_TOKEN_URL

MASTER_TOKEN=$(curl --silent --location --request POST $MASTER_TOKEN_URL \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=admin-cli' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'username='$MASTER_USERNAME \
--data-urlencode 'password='$MASTER_PASSWORD | jq -r '.access_token')
echo $MASTER_TOKEN

#3 Get client ID

CLIENT_ID=$(curl --silent --location --request GET 'http://localhost:8080/auth/admin/realms/'$REALM_NAME'/clients' \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r '. | map(select(.clientId == "my-client")) | .[0].id')
echo 'CLIENT_ID = '$CLIENT_ID

#4 Get client Role ID

ROLE_ID=$(curl --silent --location --request GET 'http://localhost:8080/auth/admin/realms/'$REALM_NAME'/clients/'$CLIENT_ID'/roles' \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r '. | map(select(.name == "client-role")) | .[0].id')
echo 'ROLE_ID = '$ROLE_ID

#5 Get Role Attributes

curl --silent --location --request GET 'http://localhost:8080/auth/admin/realms/'$REALM_NAME'/clients/'$CLIENT_ID'/roles/'$CLIENT_ROLE_NAME \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r

#6 Get User's ID

USER_ID=$(curl --silent --location --request GET 'http://localhost:8080/auth/admin/realms/'$REALM_NAME'/users' \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r '. | map(select(.username == "user1")) | .[0].id')
echo 'USER_ID = '$USER_ID

#7 Get User's role mapping

curl --silent --location --request GET 'http://localhost:8080/auth/admin/realms/'$REALM_NAME'/users/'$USER_ID'/role-mappings/clients/'$CLIENT_ID \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r