How to list service account users in keycloak

Question

Is there a way to list service account users using Keycloak API (19.x)?

I can list users using GET /admin/realms/{realm}/users, and I can access a service user account user using GET /admin/realms/{realm}/users/{service-account-user-id}, if I have such an id from, say, a user login event, but is there a way to list those?

All I need are their ids and username values.

I looked through the available Keycloak REST API documentation and I could not see it under /admin/realms/{realm}/users or /admin/realms/{realm}/clients. There are also no corresponding create and update events when those users are created by flipping Service Accounts Enabled on a client.

Answer 1

There is no endpoint to list all the service-account users.

You'll have to iterate over all the clients and find those that are configured with service-account.

Here is a working example in Java, using the Keycloak Admin client:

public void listAll() {
    final RealmResource realmResource = ...;
    final List<ClientRepresentation> clients = realmResource.clients().findAll();

    for (final ClientRepresentation client : clients) {
        if (!client.isServiceAccountsEnabled()) {
            continue;
        }
        final UserRepresentation serviceAccountUser = realmResource.clients().get(client.getId()).getServiceAccountUser();
        final String userId = serviceAccountUser.getId();
        final String userName = serviceAccountUser.getUsername());
        ...
    }
}

Kindly, from Cloud-IAM

Answer 2

This API can get user's logged events

GET {{baseUrl}}/admin/realms/{realm}/events?first={start_index}&max={limit_number}

With Master Token

Example

http://localhost:8180/admin/realms/my-realm/events?first=0&max=20

Requirement for setting get user logging events

I tested Keycloak 19.0.3

Result

UI

Detail item

More detail information for events in here

How to get master token

Tests tab

var jsonData = JSON.parse(responseBody);
postman.setEnvironmentVariable("master-token", jsonData.access_token);