Audit a User's Effective Access
A 4-step recipe with Keycloak. We can help you get access.
Recipe · 4 steps
Audit a User's Effective Access
with Keycloak · Identity & Access Management
Gather a single user's profile, realm roles, and groups for an access review.
- Resolve the account UUID from the username so the detail endpoints can be addressed. Fails fast when the username matches no account in the realm.
- Read the full user representation, which carries the enabled flag, email verification state, required actions, and federation link that a review needs alongside the entitlements.
- Read the realm-level roles granted directly to the account. These are the entitlements assigned to the person rather than inherited through a group.
- Read the groups the account belongs to. Group membership is the second source of access, and reviewing direct roles without it produces a misleading picture.
What you'll need to have ready
- realm: The name of the realm to audit within.
- username: The username of the account under review.
For your developer
Arazzo workflow keycloak:audit-user-access, 4 operations: getUsers → getUser → getUserRealmRoleMappings → getUserGroups. Specs on APIs.io.