Keycloak Admin CLI - Updating a realm with JSON file

Question

Objective:
Our objective is to update the entire realm provided a json file.

Problem:
The issue at hand is we cannot seem to update the realm entirely to include the client changes as well.

Actions taken:
Option 1: Based on the Keycloak Admin CLI documentation, a Keycloak realm can be updated from a JSON file using the following command:

kcadm.sh update realms/demorealm -f demorealm.json

However, when making an update to a property within the clients section of the JSON file (i.e. a client's description), the change is not reflected within the Keycloak realm.

We also tried to take a look at the kcadm.sh help update . We tried to utilize the merge flag (Merge new values with existing configuration on the server. Merge is automatically enabled unless --file is specified) . We do have a file specified and therefore tried to enable it using the flag - but to no success. The clients did not change as expected.

Option 2: We have tried the partial import command found in Keycloak documentation

$ kcadm.sh create partialImport -r demorealm -s ifResourceExists=OVERWRITE-o -f demorealm.json

With the ifResourceExists set to OVERWRITE, it accurately changes clients. However, it alters other Realm configurations such as assigned users roles. Ex: After manually creating a new user via the Keycloak UI and setting roles for the user, the roles are lost after running the command with the OVERWRITE flag set. Setting the ifResourceExists to SKIP does not properly update values for a client as it is skipped altogether.

Question: Is it possible, either with a different command or different flags, to update a Keycloak realm in its entirety with a single Keycloak admin command? Neither Option 1 or Option 2 listed above worked for us. We want to avoid making individual update client calls when updating the Realm.

Notes:
We have properly authenticated and confirmed that changes made at the realm level are reflected in Keycloak.

Answer 1

After further research, the approach we decided to go with is to update realm level settings with:

kcadm.sh update realms/demorealm -f demorealm.json

We then iterate over the clients and add/update them with:

kcadm.sh update clients/{clients-uuid} -f clientfile.json

Since the previous command does not update client roles, we must then use the following command to add the roles:

kcadm.sh update clients/{clients-uuid}/roles/{role-name} -f rolefile.json

Finally, to add in composite roles, we use this command:

kcadm.sh add-roles --cclientid {clientID} --rid {id of client role} --rolename {name of role to add}