Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. openid
  6. ClientAdminPermissions
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.openid.ClientAdminPermissions

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows you to manage a fine-grained admin permission for Keycloak OpenID Connect clients.

    This resource requires Fine-Grained Admin Permissions v2 (admin-fine-grained-authz:v2), available since Keycloak 26.2. See the docker-compose.yml for an example of how to enable this feature.

    Each instance of this resource represents one permission in Keycloak. A single permission can span multiple scopes, target multiple specific clients, and reference multiple policies.

    When adminPermissionsEnabled = true is set on the realm, Keycloak automatically creates an admin-permissions client that serves as the authorization resource server for all FGAPv2 admin permissions.

    Available scopes:

    • view — read the client’s configuration
    • manage — change the client’s configuration
    • map-roles — map the client’s roles to users or groups
    • map-roles-client-scope — use the client’s roles as client scopes
    • map-roles-composite — add the client’s roles as composites to other roles

    Note: The configure and token-exchange scopes from v1 (keycloak.openid.ClientPermissions) have no equivalent in FGAPv2 and are not available in this resource.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    adminPermissionsEnabled: true,
});
const adminPermissions = keycloak.openid.getClientOutput({
    realmId: realm.id,
    clientId: "admin-permissions",
});
const myClient = new keycloak.openid.Client("my_client", {
    realmId: realm.id,
    clientId: "my-client",
    accessType: "CONFIDENTIAL",
});
const admins = new keycloak.Group("admins", {
    realmId: realm.id,
    name: "admins",
});
const adminsPolicy = new keycloak.openid.ClientGroupPolicy("admins_policy", {
    realmId: realm.id,
    resourceServerId: adminPermissions.apply(adminPermissions => adminPermissions.id),
    name: "admins-policy",
    groups: [{
        id: admins.id,
        path: admins.path,
        extendChildren: false,
    }],
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
});
// Permission targeting a specific client with multiple scopes.
const adminsManageMyClient = new keycloak.openid.ClientAdminPermissions("admins_manage_my_client", {
    realmId: realm.id,
    name: "admins-manage-my-client",
    description: "Admins can view and manage my-client",
    decisionStrategy: "UNANIMOUS",
    clientIds: [myClient.id],
    scopes: [
        "view",
        "manage",
    ],
    policies: [adminsPolicy.id],
});
// Permission targeting ALL clients in the realm (client_ids omitted).
const adminsViewAllClients = new keycloak.openid.ClientAdminPermissions("admins_view_all_clients", {
    realmId: realm.id,
    name: "admins-can-view-all-clients",
    scopes: ["view"],
    policies: [adminsPolicy.id],
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    admin_permissions_enabled=True)
admin_permissions = keycloak.openid.get_client_output(realm_id=realm.id,
    client_id="admin-permissions")
my_client = keycloak.openid.Client("my_client",
    realm_id=realm.id,
    client_id="my-client",
    access_type="CONFIDENTIAL")
admins = keycloak.Group("admins",
    realm_id=realm.id,
    name="admins")
admins_policy = keycloak.openid.ClientGroupPolicy("admins_policy",
    realm_id=realm.id,
    resource_server_id=admin_permissions.id,
    name="admins-policy",
    groups=[{
        "id": admins.id,
        "path": admins.path,
        "extend_children": False,
    }],
    logic="POSITIVE",
    decision_strategy="UNANIMOUS")
# Permission targeting a specific client with multiple scopes.
admins_manage_my_client = keycloak.openid.ClientAdminPermissions("admins_manage_my_client",
    realm_id=realm.id,
    name="admins-manage-my-client",
    description="Admins can view and manage my-client",
    decision_strategy="UNANIMOUS",
    client_ids=[my_client.id],
    scopes=[
        "view",
        "manage",
    ],
    policies=[admins_policy.id])
# Permission targeting ALL clients in the realm (client_ids omitted).
admins_view_all_clients = keycloak.openid.ClientAdminPermissions("admins_view_all_clients",
    realm_id=realm.id,
    name="admins-can-view-all-clients",
    scopes=["view"],
    policies=[admins_policy.id])

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:                   pulumi.String("my-realm"),
			AdminPermissionsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		adminPermissions := openid.LookupClientOutput(ctx, openid.GetClientOutputArgs{
			RealmId:  realm.ID(),
			ClientId: pulumi.String("admin-permissions"),
		}, nil)
		myClient, err := openid.NewClient(ctx, "my_client", &openid.ClientArgs{
			RealmId:    realm.ID(),
			ClientId:   pulumi.String("my-client"),
			AccessType: pulumi.String("CONFIDENTIAL"),
		})
		if err != nil {
			return err
		}
		admins, err := keycloak.NewGroup(ctx, "admins", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins"),
		})
		if err != nil {
			return err
		}
		adminsPolicy, err := openid.NewClientGroupPolicy(ctx, "admins_policy", &openid.ClientGroupPolicyArgs{
			RealmId: realm.ID(),
			ResourceServerId: pulumi.String(adminPermissions.ApplyT(func(adminPermissions openid.GetClientResult) (*string, error) {
				return adminPermissions.Id, nil
			}).(pulumi.StringPtrOutput)),
			Name: pulumi.String("admins-policy"),
			Groups: openid.ClientGroupPolicyGroupArray{
				&openid.ClientGroupPolicyGroupArgs{
					Id:             admins.ID(),
					Path:           admins.Path,
					ExtendChildren: pulumi.Bool(false),
				},
			},
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
		})
		if err != nil {
			return err
		}
		// Permission targeting a specific client with multiple scopes.
		_, err = openid.NewClientAdminPermissions(ctx, "admins_manage_my_client", &openid.ClientAdminPermissionsArgs{
			RealmId:          realm.ID(),
			Name:             pulumi.String("admins-manage-my-client"),
			Description:      pulumi.String("Admins can view and manage my-client"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			ClientIds: pulumi.StringArray{
				myClient.ID(),
			},
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
				pulumi.String("manage"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		// Permission targeting ALL clients in the realm (client_ids omitted).
		_, err = openid.NewClientAdminPermissions(ctx, "admins_view_all_clients", &openid.ClientAdminPermissionsArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins-can-view-all-clients"),
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        AdminPermissionsEnabled = true,
    });

    var adminPermissions = Keycloak.OpenId.GetClient.Invoke(new()
    {
        RealmId = realm.Id,
        ClientId = "admin-permissions",
    });

    var myClient = new Keycloak.OpenId.Client("my_client", new()
    {
        RealmId = realm.Id,
        ClientId = "my-client",
        AccessType = "CONFIDENTIAL",
    });

    var admins = new Keycloak.Group("admins", new()
    {
        RealmId = realm.Id,
        Name = "admins",
    });

    var adminsPolicy = new Keycloak.OpenId.ClientGroupPolicy("admins_policy", new()
    {
        RealmId = realm.Id,
        ResourceServerId = adminPermissions.Apply(getClientResult => getClientResult.Id),
        Name = "admins-policy",
        Groups = new[]
        {
            new Keycloak.OpenId.Inputs.ClientGroupPolicyGroupArgs
            {
                Id = admins.Id,
                Path = admins.Path,
                ExtendChildren = false,
            },
        },
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
    });

    // Permission targeting a specific client with multiple scopes.
    var adminsManageMyClient = new Keycloak.OpenId.ClientAdminPermissions("admins_manage_my_client", new()
    {
        RealmId = realm.Id,
        Name = "admins-manage-my-client",
        Description = "Admins can view and manage my-client",
        DecisionStrategy = "UNANIMOUS",
        ClientIds = new[]
        {
            myClient.Id,
        },
        Scopes = new[]
        {
            "view",
            "manage",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

    // Permission targeting ALL clients in the realm (client_ids omitted).
    var adminsViewAllClients = new Keycloak.OpenId.ClientAdminPermissions("admins_view_all_clients", new()
    {
        RealmId = realm.Id,
        Name = "admins-can-view-all-clients",
        Scopes = new[]
        {
            "view",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.OpenidFunctions;
import com.pulumi.keycloak.openid.inputs.GetClientArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.Group;
import com.pulumi.keycloak.GroupArgs;
import com.pulumi.keycloak.openid.ClientGroupPolicy;
import com.pulumi.keycloak.openid.ClientGroupPolicyArgs;
import com.pulumi.keycloak.openid.inputs.ClientGroupPolicyGroupArgs;
import com.pulumi.keycloak.openid.ClientAdminPermissions;
import com.pulumi.keycloak.openid.ClientAdminPermissionsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .adminPermissionsEnabled(true)
            .build());

        final var adminPermissions = OpenidFunctions.getClient(GetClientArgs.builder()
            .realmId(realm.id())
            .clientId("admin-permissions")
            .build());

        var myClient = new Client("myClient", ClientArgs.builder()
            .realmId(realm.id())
            .clientId("my-client")
            .accessType("CONFIDENTIAL")
            .build());

        var admins = new Group("admins", GroupArgs.builder()
            .realmId(realm.id())
            .name("admins")
            .build());

        var adminsPolicy = new ClientGroupPolicy("adminsPolicy", ClientGroupPolicyArgs.builder()
            .realmId(realm.id())
            .resourceServerId(adminPermissions.applyValue(_adminPermissions -> _adminPermissions.id()))
            .name("admins-policy")
            .groups(ClientGroupPolicyGroupArgs.builder()
                .id(admins.id())
                .path(admins.path())
                .extendChildren(false)
                .build())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .build());

        // Permission targeting a specific client with multiple scopes.
        var adminsManageMyClient = new ClientAdminPermissions("adminsManageMyClient", ClientAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-manage-my-client")
            .description("Admins can view and manage my-client")
            .decisionStrategy("UNANIMOUS")
            .clientIds(myClient.id())
            .scopes(            
                "view",
                "manage")
            .policies(adminsPolicy.id())
            .build());

        // Permission targeting ALL clients in the realm (client_ids omitted).
        var adminsViewAllClients = new ClientAdminPermissions("adminsViewAllClients", ClientAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-can-view-all-clients")
            .scopes("view")
            .policies(adminsPolicy.id())
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      adminPermissionsEnabled: true
  myClient:
    type: keycloak:openid:Client
    name: my_client
    properties:
      realmId: ${realm.id}
      clientId: my-client
      accessType: CONFIDENTIAL
  admins:
    type: keycloak:Group
    properties:
      realmId: ${realm.id}
      name: admins
  adminsPolicy:
    type: keycloak:openid:ClientGroupPolicy
    name: admins_policy
    properties:
      realmId: ${realm.id}
      resourceServerId: ${adminPermissions.id}
      name: admins-policy
      groups:
        - id: ${admins.id}
          path: ${admins.path}
          extendChildren: false
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
  # Permission targeting a specific client with multiple scopes.
  adminsManageMyClient:
    type: keycloak:openid:ClientAdminPermissions
    name: admins_manage_my_client
    properties:
      realmId: ${realm.id}
      name: admins-manage-my-client
      description: Admins can view and manage my-client
      decisionStrategy: UNANIMOUS
      clientIds:
        - ${myClient.id}
      scopes:
        - view
        - manage
      policies:
        - ${adminsPolicy.id}
  # Permission targeting ALL clients in the realm (client_ids omitted).
  adminsViewAllClients:
    type: keycloak:openid:ClientAdminPermissions
    name: admins_view_all_clients
    properties:
      realmId: ${realm.id}
      name: admins-can-view-all-clients
      scopes:
        - view
      policies:
        - ${adminsPolicy.id}
variables:
  adminPermissions:
    fn::invoke:
      function: keycloak:openid:getClient
      arguments:
        realmId: ${realm.id}
        clientId: admin-permissions

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

data "keycloak_openid_getclient" "adminPermissions" {
  realm_id  = keycloak_realm.realm.id
  client_id = "admin-permissions"
}

resource "keycloak_realm" "realm" {
  realm                     = "my-realm"
  admin_permissions_enabled = true
}
resource "keycloak_openid_client" "my_client" {
  realm_id    = keycloak_realm.realm.id
  client_id   = "my-client"
  access_type = "CONFIDENTIAL"
}
resource "keycloak_group" "admins" {
  realm_id = keycloak_realm.realm.id
  name     = "admins"
}
resource "keycloak_openid_clientgrouppolicy" "admins_policy" {
  realm_id           = keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_getclient.adminPermissions.id
  name               = "admins-policy"
  groups {
    id              = keycloak_group.admins.id
    path            = keycloak_group.admins.path
    extend_children = false
  }
  logic             = "POSITIVE"
  decision_strategy = "UNANIMOUS"
}
# Permission targeting a specific client with multiple scopes.
resource "keycloak_openid_clientadminpermissions" "admins_manage_my_client" {
  realm_id          = keycloak_realm.realm.id
  name              = "admins-manage-my-client"
  description       = "Admins can view and manage my-client"
  decision_strategy = "UNANIMOUS"
  client_ids        = [keycloak_openid_client.my_client.id]
  scopes            = ["view", "manage"]
  policies          = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}
# Permission targeting ALL clients in the realm (client_ids omitted).
resource "keycloak_openid_clientadminpermissions" "admins_view_all_clients" {
  realm_id = keycloak_realm.realm.id
  name     = "admins-can-view-all-clients"
  scopes   = ["view"]
  policies = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}

    Create ClientAdminPermissions Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ClientAdminPermissions(name: string, args: ClientAdminPermissionsArgs, opts?: CustomResourceOptions);
    @overload
def ClientAdminPermissions(resource_name: str,
                           args: ClientAdminPermissionsArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def ClientAdminPermissions(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           realm_id: Optional[str] = None,
                           scopes: Optional[Sequence[str]] = None,
                           client_ids: Optional[Sequence[str]] = None,
                           decision_strategy: Optional[str] = None,
                           description: Optional[str] = None,
                           name: Optional[str] = None,
                           policies: Optional[Sequence[str]] = None)
    func NewClientAdminPermissions(ctx *Context, name string, args ClientAdminPermissionsArgs, opts ...ResourceOption) (*ClientAdminPermissions, error)
    public ClientAdminPermissions(string name, ClientAdminPermissionsArgs args, CustomResourceOptions? opts = null)
    public ClientAdminPermissions(String name, ClientAdminPermissionsArgs args)
public ClientAdminPermissions(String name, ClientAdminPermissionsArgs args, CustomResourceOptions options)

    type: keycloak:openid:ClientAdminPermissions
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_openid_client_admin_permissions" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args ClientAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ClientAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ClientAdminPermissionsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ClientAdminPermissionsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ClientAdminPermissionsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var clientAdminPermissionsResource = new Keycloak.OpenId.ClientAdminPermissions("clientAdminPermissionsResource", new()
{
    RealmId = "string",
    Scopes = new[]
    {
        "string",
    },
    ClientIds = new[]
    {
        "string",
    },
    DecisionStrategy = "string",
    Description = "string",
    Name = "string",
    Policies = new[]
    {
        "string",
    },
});

    example, err := openid.NewClientAdminPermissions(ctx, "clientAdminPermissionsResource", &openid.ClientAdminPermissionsArgs{
	RealmId: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	ClientIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	DecisionStrategy: pulumi.String("string"),
	Description:      pulumi.String("string"),
	Name:             pulumi.String("string"),
	Policies: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "keycloak_openid_client_admin_permissions" "clientAdminPermissionsResource" {
  lifecycle {
    create_before_destroy = true
  }
  realm_id          = "string"
  scopes            = ["string"]
  client_ids        = ["string"]
  decision_strategy = "string"
  description       = "string"
  name              = "string"
  policies          = ["string"]
}

    var clientAdminPermissionsResource = new ClientAdminPermissions("clientAdminPermissionsResource", ClientAdminPermissionsArgs.builder()
    .realmId("string")
    .scopes("string")
    .clientIds("string")
    .decisionStrategy("string")
    .description("string")
    .name("string")
    .policies("string")
    .build());

    client_admin_permissions_resource = keycloak.openid.ClientAdminPermissions("clientAdminPermissionsResource",
    realm_id="string",
    scopes=["string"],
    client_ids=["string"],
    decision_strategy="string",
    description="string",
    name="string",
    policies=["string"])

    const clientAdminPermissionsResource = new keycloak.openid.ClientAdminPermissions("clientAdminPermissionsResource", {
    realmId: "string",
    scopes: ["string"],
    clientIds: ["string"],
    decisionStrategy: "string",
    description: "string",
    name: "string",
    policies: ["string"],
});

    type: keycloak:openid:ClientAdminPermissions
properties:
    clientIds:
        - string
    decisionStrategy: string
    description: string
    name: string
    policies:
        - string
    realmId: string
    scopes:
        - string

    ClientAdminPermissions Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ClientAdminPermissions resource accepts the following input properties:

    RealmId string
    The realm in which to manage this permission.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    ClientIds List<string>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes []string
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    ClientIds []string
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    Policies []string
    Set of policy IDs to attach to the permission.
    realm_id string
    The realm in which to manage this permission.
    scopes list(string)
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    client_ids list(string)
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies list(string)
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    clientIds List<String>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId string
    The realm in which to manage this permission.
    scopes string[]
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    clientIds string[]
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies string[]
    Set of policy IDs to attach to the permission.
    realm_id str
    The realm in which to manage this permission.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    client_ids Sequence[str]
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    clientIds List<String>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    policies List<String>
    Set of policy IDs to attach to the permission.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ClientAdminPermissions resource produces the following output properties:

    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    Enabled bool
    Always true when the resource exists.
    Id string
    The provider-assigned unique ID for this managed resource.
    PermissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permission_id string
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled boolean
    Always true when the resource exists.
    id string
    The provider-assigned unique ID for this managed resource.
    permissionId string
    The internal Keycloak UUID of the permission.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled bool
    Always true when the resource exists.
    id str
    The provider-assigned unique ID for this managed resource.
    permission_id str
    The internal Keycloak UUID of the permission.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    enabled Boolean
    Always true when the resource exists.
    id String
    The provider-assigned unique ID for this managed resource.
    permissionId String
    The internal Keycloak UUID of the permission.

    Look up Existing ClientAdminPermissions Resource

    Get an existing ClientAdminPermissions resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ClientAdminPermissionsState, opts?: CustomResourceOptions): ClientAdminPermissions
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        authorization_resource_server_id: Optional[str] = None,
        client_ids: Optional[Sequence[str]] = None,
        decision_strategy: Optional[str] = None,
        description: Optional[str] = None,
        enabled: Optional[bool] = None,
        name: Optional[str] = None,
        permission_id: Optional[str] = None,
        policies: Optional[Sequence[str]] = None,
        realm_id: Optional[str] = None,
        scopes: Optional[Sequence[str]] = None) -> ClientAdminPermissions
    func GetClientAdminPermissions(ctx *Context, name string, id IDInput, state *ClientAdminPermissionsState, opts ...ResourceOption) (*ClientAdminPermissions, error)
    public static ClientAdminPermissions Get(string name, Input<string> id, ClientAdminPermissionsState? state, CustomResourceOptions? opts = null)
    public static ClientAdminPermissions get(String name, Output<String> id, ClientAdminPermissionsState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:openid:ClientAdminPermissions    get:      id: ${id}
    import {
  to = keycloak_openid_client_admin_permissions.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    ClientIds List<string>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies List<string>
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes List<string>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    AuthorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    ClientIds []string
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    DecisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    Description string
    Description of the permission.
    Enabled bool
    Always true when the resource exists.
    Name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    PermissionId string
    The internal Keycloak UUID of the permission.
    Policies []string
    Set of policy IDs to attach to the permission.
    RealmId string
    The realm in which to manage this permission.
    Scopes []string
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    authorization_resource_server_id string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    client_ids list(string)
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decision_strategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id string
    The internal Keycloak UUID of the permission.
    policies list(string)
    Set of policy IDs to attach to the permission.
    realm_id string
    The realm in which to manage this permission.
    scopes list(string)
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    clientIds List<String>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    authorizationResourceServerId string
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    clientIds string[]
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy string
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description string
    Description of the permission.
    enabled boolean
    Always true when the resource exists.
    name string
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId string
    The internal Keycloak UUID of the permission.
    policies string[]
    Set of policy IDs to attach to the permission.
    realmId string
    The realm in which to manage this permission.
    scopes string[]
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    authorization_resource_server_id str
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    client_ids Sequence[str]
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decision_strategy str
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description str
    Description of the permission.
    enabled bool
    Always true when the resource exists.
    name str
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permission_id str
    The internal Keycloak UUID of the permission.
    policies Sequence[str]
    Set of policy IDs to attach to the permission.
    realm_id str
    The realm in which to manage this permission.
    scopes Sequence[str]
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.
    authorizationResourceServerId String
    The ID of the admin-permissions client, which acts as the resource server for these permissions.
    clientIds List<String>
    Set of client UUIDs (keycloak_openid_client.xxx.id) this permission applies to. When omitted or empty, the permission applies to all clients in the realm.
    decisionStrategy String
    Decision strategy. One of UNANIMOUS, AFFIRMATIVE, or CONSENSUS. Defaults to UNANIMOUS.
    description String
    Description of the permission.
    enabled Boolean
    Always true when the resource exists.
    name String
    The name of the permission. Must be unique within the admin-permissions resource server. On first apply, if a permission with this name already exists it is adopted; otherwise a new one is created.
    permissionId String
    The internal Keycloak UUID of the permission.
    policies List<String>
    Set of policy IDs to attach to the permission.
    realmId String
    The realm in which to manage this permission.
    scopes List<String>
    Set of scopes this permission grants. Valid values: view, manage, map-roles, map-roles-client-scope, map-roles-composite.

    Import

    OpenID client admin permissions can be imported using {{realmId}}/{{permissionId}}:

    $ pulumi import keycloak:openid/clientAdminPermissions:ClientAdminPermissions example my-realm/permission-uuid

    After import, run pulumi up to reconcile clientIds, scopes, and policies with your configuration.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial