使用Curl在Keycloak创建用户时出现unknown_error错误求助

操作流程 #

我尝试通过以下步骤用Curl在Keycloak中创建用户：

1. 获取授权令牌：

echo "* Request for authorization"
RESULT=`curl --data "username=admin&password=admin&grant_type=password&client_id=admin-cli" http://localhost:8080/auth/realms/master/protocol/openid-connect/token`

2. 提取令牌：

echo "Recovery of the token"
TOKEN=`echo $RESULT | sed 's/.*access_token":"//g' | sed 's/".*//g'`

3. 创建用户：

echo "user creation"
curl -v http://localhost:8080/auth/admin/realms/teste/users -H "Content-Type: application/json" -H "Authorization: bearer $TOKEN" --data '{"username": "user12", "firstName":"User","lastName":"Test", "email":"user12@randomemail.com", "enabled":"true", "emailVerified": false, "totp": true, "credentials": [ { "type": "password", "value": "admin.1","temporary": false } ], "groups": ["test","monitor"]}'

错误响应 #

执行后返回{"error":"unknown_error"}，完整请求响应如下：

* Request for authorization
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  1906  100  1837  100    69  23857    896 --:--:-- --:--:-- --:--:-- 24753
Recovery of the token
user creation
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 8080 (#0)
> POST /auth/admin/realms/teste/users HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.64.1
> Accept: */*
> Content-Type: application/json
> Authorization: bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJnVkE4bkRJbHU5VS1DY1RyTm1pczNQaDF5TDhGbEs0ZGE1U2tBWndtY25jIn0.eyJleHAiOjE2NjE1MDMxMjcsImlhdCI6MTY2MTUwMzA2NywianRpIjoiMWU2YmUwYzktMDYyOC00NGFhLWE1ZjMtN2UxZjk1NjdkZjczIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgwL2F1dGgvcmVhbG1zL21hc3RlciIsInN1YiI6IjY3Mzk3NzI2LTM0ZDAtNDQ2NC04Mjk1LWJjZGM3Yjg3YTU2YyIsInR5cCI6IkJlYXJlciIsImF6cCI6ImFkbWluLWNsaSIsInNlc3Npb25fc3RhdGUiOiI1MDRiYjRkNS0yNTkwLTQ2NmUtYTJkYy01OTQzNGRlZmM3ODciLCJhY3IiOiIxIiwic2NvcGUiOiJlbWFpbCBwcm9maWxlIiwic2lkIjoiNTA0YmI0ZDUtMjU5MC00NjZlLWEyZGMtNTk0MzRkZWZjNzg3IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJhZG1pbiJ9.ggeUu-qpOErUkS_dpESqKcX4_IaojeETpHgOfR2pwx6TdxbY-Xbnq5IP0Xw4QU88neIzZd1GDSkKrO5KGKWptypsu5lIkwD_RqwFa_DSxhsunJvd4ZndEjN7ZgE5W41XCfYfgZNe9tEUnmlhosmBznM_NgsHfMJmzdJcO6m3-kgDn0xRnRL8r-jWuOzO1hp7TrR_3RePaYw_su_GxtFZtV1gtjoDw8xz8RPY6zia6jgn86a1A5npRyeSf8gAqOcKbqIbc6DdwqX-h-0NMin0S3ipeQDHR_C_I0NKuGF1I5zBsmUK7mFPpQT3vXmTvti7TUr4KdFmX67W4_ig4T8Ung
> Content-Length: 278
> 
* upload completely sent off: 278 out of 278 bytes
< HTTP/1.1 500 Internal Server Error
< X-XSS-Protection: 1; mode=block
< X-Frame-Options: SAMEORIGIN
< Referrer-Policy: no-referrer
< Date: Fri, 26 Aug 2022 08:37:47 GMT
< Connection: keep-alive
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Content-Type-Options: nosniff
< Content-Type: application/json
< Content-Length: 25
< 
* Connection #0 to host localhost left intact
{"error":"unknown_error"}* Closing connection 0

可能的解决方案 #

1. 修正JSON格式错误 #

创建用户的JSON数据中，enabled字段被设置为字符串"true"，但Keycloak要求该字段为布尔值（不带引号）。将"enabled":"true"改为"enabled":true，修正后的创建命令如下：

curl -v http://localhost:8080/auth/admin/realms/teste/users -H "Content-Type: application/json" -H "Authorization: bearer $TOKEN" --data '{"username": "user12", "firstName":"User","lastName":"Test", "email":"user12@randomemail.com", "enabled":true, "emailVerified": false, "totp": true, "credentials": [ { "type": "password", "value": "admin.1","temporary": false } ], "groups": ["test","monitor"]}'

2. 验证目标组是否存在 #

groups字段中指定的test和monitor组必须在teste realm中已创建。如果组不存在，Keycloak可能会抛出内部错误，需先通过Keycloak控制台或API创建对应的组。

3. 查看Keycloak服务器日志 #

500错误的详细原因通常会记录在Keycloak的服务器日志中（默认路径为standalone/logs/server.log），查看日志可以获取更具体的错误信息，比如JSON解析异常、权限问题等，帮助精准定位问题。

4. 确认令牌权限 #

使用JWT解析工具解析获取的令牌，确认令牌包含manage-users等管理用户所需的权限。admin用户通过admin-cli获取的令牌默认具备足够权限，但如果有自定义权限配置，需验证权限是否覆盖teste realm的用户管理操作。

内容的提问来源于stack exchange，提问作者pawansgi92