README

Keycloak Admin REST API Client

PHP client to interact with Keycloak's Admin REST API.

Inspired by keycloak/keycloak-nodejs-admin-client.

This is a fork of fschmtt/keycloak-rest-api-client-php

Installation

Install via Composer:

composer require overtrue/keycloak-rest-api-client-php

Usage

Example:

$keycloak = new \Overtrue\Keycloak\Keycloak(
    baseUrl: 'http://keycloak:8080',
    username: 'admin',
    password: 'admin'
);

$serverInfo = $keycloak->serverInfo()->get();

echo sprintf(
    'Keycloak %s is running on %s/%s (%s) with %s/%s since %s and is currently using %s of %s (%s %%) memory.',
    $serverInfo->getSystemInfo()->getVersion(),
    $serverInfo->getSystemInfo()->getOsName(),
    $serverInfo->getSystemInfo()->getOsVersion(),
    $serverInfo->getSystemInfo()->getOsArchitecture(),
    $serverInfo->getSystemInfo()->getJavaVm(),
    $serverInfo->getSystemInfo()->getJavaVersion(),
    $serverInfo->getSystemInfo()->getUptime(),
    $serverInfo->getMemoryInfo()->getUsedFormated(),
    $serverInfo->getMemoryInfo()->getTotalFormated(),
    100 - $serverInfo->getMemoryInfo()->getFreePercentage(),
);

will print e.g.

Keycloak 26.0.0 is running on Linux/5.10.25-linuxkit (amd64) with OpenJDK 64-Bit Server VM/11.0.11 since 0 days, 2 hours, 37 minutes, 7 seconds and is currently using 139 MB of 512 MB (28 %) memory.

More examples can be found in the examples directory.

Customization

Custom representations & resources

You can register and use custom resources by providing your own representations and resources, e.g.:

class MyCustomRepresentation extends \Overtrue\Keycloak\Representation\Representation
{
    public function __construct(
        protected ?string $id = null,
        protected ?string $name = null,
    ) {
    }
}

class MyCustomResource extends \Overtrue\Keycloak\Resource\Resource
{
    public function myCustomEndpoint(): MyCustomRepresentation
    {
        return $this->queryExecutor->executeQuery(
            new \Overtrue\Keycloak\Http\Query(
                '/my-custom-endpoint',
                MyCustomRepresentation::class,
            )
        );
    }
}

By extending the Resource class, you have access to both the QueryExecutor and CommandExecutor. The CommandExecutor is designed to run state-changing commands against the server (without returning a response); the QueryExecutor allows fetching resources and representations from the server.

To use your custom resource, pass the fully-qualified class name (FQCN) to the Keycloak::resource() method. It provides you with an instance of your resource you can then work with:

$keycloak = new Keycloak(
    $_SERVER['KEYCLOAK_BASE_URL'] ?? 'http://keycloak:8080',
    'admin',
    'admin',
);

$myCustomResource = $keycloak->resource(MyCustomResource::class);
$myCustomRepresentation = $myCustomResource->myCustomEndpoint();

Available Resources

Attack Detection

Endpoint	Response	API
`DELETE /admin/realms/{realm}/attack-detection/brute-force/users`	ResponseInterface	AttackDetection::clear()
`GET /admin/realms/{realm}/attack-detection/brute-force/users/{userId}`	Map	AttackDetection::userStatus()
`DELETE /admin/realms/{realm}/attack-detection/brute-force/users/{userId}`	ResponseInterface	AttackDetection::clearUser()

Clients

Endpoint	Response	API
`GET /admin/realms/{realm}/clients`	ClientCollection	Clients::all()
`GET /admin/realms/{realm}/clients/{client-uuid}`	Client	Clients::get()
`PUT /admin/realms/{realm}/clients/{client-uuid}`	Client	Clients::update()
`POST /admin/realms/{realm}/clients`	Client	Clients::import()
`GET /admin/realms/{realm}/clients/{client-uuid}/client-secret`	Client	Clients::getClientSecret()

Groups

Endpoint	Response	API
`GET /admin/realms/{realm}/groups`	GroupCollection	Groups::all()
`GET /admin/realms/{realm}/groups/{id}/children`	GroupCollection	Groups::children()
`GET /admin/realms/{realm}/groups/{id}/members`	UserCollection	Groups::members()
`GET /admin/realms/{realm}/groups/{id}`	Group	Groups::get()
`PUT /admin/realms/{realm}/groups/{id}`	ResponseInterface	Groups::update()
`POST /admin/realms/{realm}/groups`	ResponseInterface	Groups::create()
`POST /admin/realms/{realm}/groups/{id}/children`	ResponseInterface	Groups::create()
`DELETE /admin/realms/{realm}/groups`	ResponseInterface	Groups::delete()
`GET /admin/realms/{realm}/group-by-path/{path}`	Group	Groups::byPath()

Organizations

Endpoint	Response	API
`GET /admin/realms/{realm}/organizations`	OrganizationCollection	Organizations::all()
`GET /admin/realms/{realm}/organizations/{id}`	Organization	Organizations::get()
`POST /admin/realms/{realm}/organizations`	ResponseInterface	Organizations::create()
`DELETE /admin/realms/{realm}/organizations/{id}`	ResponseInterface	Organizations::delete()
`GET /admin/realms/{realm}/organizations/{id}/members`	MemberCollection	Organizations::members()
`GET /admin/realms/{realm}/organizations/{id}/members/count`	ResponseInterface	Organizations::membersCount()
`POST /admin/realms/{realm}/organizations/{id}/members`	ResponseInterface	Organizations::addMember()
`DELETE /admin/realms/{realm}/organizations/{id}/members/{member-id}`	ResponseInterface	Organizations::deleteMember()
`GET /admin/realms/{realm}/organizations/{id}/members/{member-id}/orgainzations`	OrganizationCollection	Organizations::memberOrganizations()
`POST /admin/realms/{realm}/organizations/{id}/members/invite-user`	ResponseInterface	Organizations::inviteUser()
`POST /admin/realms/{realm}/organizations/{id}/members/invite-existing-user`	ResponseInterface	Organizations::inviteExistingUser()
`POST /admin/realms/{realm}/organizations/{id}/identity-providers`	ResponseInterface	Organizations::linkIdp()
`DELETE /admin/realms/{realm}/organizations/{id}/identity-providers/{alias}`	ResponseInterface	Organizations::unlinkIdp()

Realms Admin

Endpoint	Response	API
`POST /admin/realms`	Realm	Realms::import()
`GET /admin/realms`	RealmCollection	Realms::all()
`PUT /admin/realms/{realm}`	Realm	Realms::update()
`DELETE /admin/realms/{realm}`	ResponseInterface	Realms::delete()
`GET /admin/realms/{realm}/admin-events`	`array`	Realms::adminEvents()
`GET /admin/realms/{realm}/keys`	KeysMetadata	Realms::keys()
`DELETE /admin/realms/{realm}/admin-events`	ResponseInterface	Realms::deleteAdminEvents()
`POST /admin/realms/{realm}/clear-keys-cache`	ResponseInterface	Realms::clearKeysCache()
`POST /admin/realms/{realm}/clear-realm-cache`	ResponseInterface	Realms::clearRealmCache()
`POST /admin/realms/{realm}/clear-user-cache`	ResponseInterface	Realms::clearUserCache()

Users

Endpoint	Response	API
`GET /admin/realms/{realm}/users`	UserCollection	Users::all()
`POST /admin/realms/{realm}/users`	ResponseInterface	Users::create()
`GET /admin/realms/{realm}/users/{userId}`	User	Users::get()
`PUT /admin/realms/{realm}/users/{userId}`	ResponseInterface	Users::update()
`DELETE /admin/realms/{realm}/users/{userId}`	ResponseInterface	Users::delete()
`GET /admin/realms/{realm}/users`	UserCollection	Users::search()
`PUT /{realm}/users/{id}/groups/{groupId}`	ResponseInterface	Users::joinGroup()
`DELETE /{realm}/users/{id}/groups/{groupId}`	ResponseInterface	Users::leaveGroup()
`GET /{realm}/users/{id}/groups`	GroupCollection	Users::retrieveGroups()
`GET /{realm}/users/{id}/role-mappings/realm`	RoleCollection	Users::retrieveRealmRoles()
`GET /{realm}/users/{id}/role-mappings/realm/available`	RoleCollection	Users::retrieveAvailableRealmRoles()
`POST /{realm}/users/{id}/role-mappings/realm`	ResponseInterface	Users::addRealmRoles()
`DELETE /{realm}/users/{id}/role-mappings/realm`	ResponseInterface	Users::removeRealmRoles()
`PUT /{realm}/users/{id}/execute-actions-email`	ResponseInterface	Users::executeActionsEmail()
`GET /admin/realms/{realm}/users/{userId}/credentials`	CredentialCollection	Users::credentials()

Roles

Endpoint	Response	API
`GET /admin/realms/{realm}/roles`	RoleCollection	Roles::all()
`GET /admin/realms/{realm}/roles/{roleName}`	Role	Roles::get()
`POST /admin/realms/{realm}/roles`	ResponseInterface	Roles::create()
`DELETE /admin/realms/{realm}/roles/{roleName}`	ResponseInterface	Roles::delete()

Root

Endpoint	Response	API
`GET /admin/serverinfo`	ServerInfo	ServerInfo::get()

Local development and testing

Run docker compose up -d keycloak to start a local Keycloak instance listening on http://localhost:8080.

Run your script (e.g. examples/serverinfo.php) from within the php container:

docker compose run --rm php php examples/serverinfo.php

Composer scripts

analyze: Run phpstan analysis
fix: Fix coding style issues (Laravel pint)
test: Run unit and integration tests
test:unit: Run unit tests
test:integration: Run integration tests (requires a fresh and running Keycloak instance)

overtrue / keycloak-rest-api-client-php

Maintainers

Details