capabilities.work

Audit Group Membership

A 4-step recipe with Keycloak. We can help you get access.

Recipe · 4 steps

Audit Group Membership

with Keycloak · Identity & Access Management

Read a group's roles and member roster, with a spot check of one member's direct roles.

  1. Resolve the group UUID by searching top-level groups by name so the detail and member endpoints can be addressed.
  2. Read the group representation, which carries the realm and client roles attached to the group. These are the entitlements every member inherits simply by being in it.
  3. Page the group's member roster. This is the list of accounts that inherit every role captured in the previous step.
  4. Spot-check the first member's directly granted realm roles, so the reviewer can compare inherited access against individual grants. A full roster review means repeating this per member id.
What you'll need to have ready
  • realm: The name of the realm to audit within.
  • groupName: The name of the top-level group under review.
  • max: Maximum number of members to return in the roster page. Large groups need this raised or the roster paged with the first input.
  • first: Pagination offset into the member roster.
For your developer

Arazzo workflow keycloak:audit-group-membership, 4 operations: getGroups → getGroup → getGroupMembers → getUserRealmRoleMappings. Specs on APIs.io.

More recipes with Keycloak

Assign a User to a GroupAudit a User's Effective AccessDecommission a ClientFederate an Identity ProviderApply a Realm Security BaselineInventory a RealmOffboard a UserOnboard a UserProvision a Group HierarchyRegister a Confidential OIDC Client