Inventory a Realm
A 6-step recipe with Keycloak. We can help you get access.
Recipe · 6 steps
Inventory a Realm
with Keycloak · Cybersecurity Management
Assemble a read-only configuration inventory of a single realm.
- List every realm the authenticated token can see. This scopes the exercise and reveals realms an operator may not have known were there.
- Read the target realm's representation, capturing the security posture that every client, role, and group in the inventory inherits.
- Read the realm's registered clients. This is the application surface: every client here is a way into the realm.
- Read the realm-level role catalog. These are the entitlements that onboarding and role mapping workflows draw from.
- Read the top-level group tree. Note this returns root groups; nested subgroups come back inside each group's subGroups property rather than as separate entries.
- Read the federated identity providers. Each one is an external trust relationship, and therefore part of the realm's attack surface.
What you'll need to have ready
- realm: The name of the realm to inventory.
- max: Maximum number of clients, roles, and groups to return per catalog. An estate larger than this needs the catalogs paged.
For your developer
Arazzo workflow keycloak:inventory-realm, 6 operations: getRealms → getRealm → getClients → getRoles → getGroups → getIdentityProviders. Specs on APIs.io.