如何用Java Keycloak-Admin-Client列出客户端的所有Scope权限？

现状确认 #

Keycloak 23.0.6的keycloak-admin-client确实未封装GET /admin/realms/<realm>/clients/<client-id>/authz/resource-server/permission/scope这个列表Scope权限的接口，属于客户端库的功能遗漏；而keycloak-authz-client定位是资源端授权调用，本身不提供Admin级别的权限管理能力，所以确实找不到对应方法。

可行解决方式 #

方式1：利用keycloak-admin-client的底层HTTP客户端调用

无需重新处理认证，直接复用AdminClient的已有配置和token，示例代码如下：

import org.keycloak.admin.client.Keycloak;
import org.keycloak.representations.idm.authorization.ScopePermissionRepresentation;
import jakarta.ws.rs.core.Response;
import java.util.List;
import jakarta.ws.rs.core.GenericType;

// 假设已初始化好Keycloak实例keycloak
String realm = "realm-name";
String clientId = "client-id";

// 构造请求路径
String path = String.format("/admin/realms/%s/clients/%s/authz/resource-server/permission/scope", realm, clientId);

// 调用底层REST客户端发送GET请求
Response response = keycloak.realm(realm).clients().get(clientId).authorization().getRealmResource().getRestClient().target(path).request().get();

// 解析响应为ScopePermissionRepresentation列表
List<ScopePermissionRepresentation> scopePermissions = response.readEntity(new GenericType<List<ScopePermissionRepresentation>>() {});
response.close();

方式2：手动实现HTTP请求

如果不想依赖AdminClient的底层API，可直接用Spring的RestTemplate或WebClient，先获取Admin权限的token，再调用目标端点：

import org.springframework.web.client.RestTemplate;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpEntity;
import org.springframework.core.ParameterizedTypeReference;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

// 1. 获取Admin Token
String tokenUrl = "http://your-keycloak-server/auth/realms/master/protocol/openid-connect/token";
Map<String, String> tokenParams = new HashMap<>();
tokenParams.put("grant_type", "password");
tokenParams.put("client_id", "admin-cli");
tokenParams.put("username", "admin-username");
tokenParams.put("password", "admin-password");

RestTemplate restTemplate = new RestTemplate();
Map<String, Object> tokenResponse = restTemplate.postForObject(tokenUrl, tokenParams, Map.class);
String accessToken = (String) tokenResponse.get("access_token");

// 2. 调用Scope权限列表接口
String scopePermissionUrl = "http://your-keycloak-server/auth/admin/realms/{realm}/clients/{clientId}/authz/resource-server/permission/scope";
Map<String, String> urlParams = new HashMap<>();
urlParams.put("realm", "realm-name");
urlParams.put("clientId", "client-id");

List<Map<String, Object>> scopePermissions = restTemplate.exchange(
        scopePermissionUrl,
        HttpMethod.GET,
        new HttpEntity<>(null, Map.of("Authorization", "Bearer " + accessToken)),
        new ParameterizedTypeReference<List<Map<String, Object>>>() {},
        urlParams
).getBody();

补充说明 #

后续可以关注Keycloak版本更新，确认是否在后续版本的keycloak-admin-client中补全了该接口的封装。

内容的提问来源于stack exchange，提问作者Huldula