keycloak.UsersAdminPermissions

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    adminPermissionsEnabled: true,
});
const adminPermissions = keycloak.openid.getClientOutput({
    realmId: realm.id,
    clientId: "admin-permissions",
});
const admins = new keycloak.Group("admins", {
    realmId: realm.id,
    name: "admins",
});
const auditors = new keycloak.Group("auditors", {
    realmId: realm.id,
    name: "auditors",
});
const adminsPolicy = new keycloak.openid.ClientGroupPolicy("admins_policy", {
    realmId: realm.id,
    resourceServerId: adminPermissions.apply(adminPermissions => adminPermissions.id),
    name: "admins-policy",
    groups: [{
        id: admins.id,
        path: admins.path,
        extendChildren: false,
    }],
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
});
const auditorsPolicy = new keycloak.openid.ClientGroupPolicy("auditors_policy", {
    realmId: realm.id,
    resourceServerId: adminPermissions.apply(adminPermissions => adminPermissions.id),
    name: "auditors-policy",
    groups: [{
        id: auditors.id,
        path: auditors.path,
        extendChildren: false,
    }],
    logic: "POSITIVE",
    decisionStrategy: "UNANIMOUS",
});
// One permission per logical role — each is a separate Terraform resource.
const adminsManageUsers = new keycloak.UsersAdminPermissions("admins_manage_users", {
    realmId: realm.id,
    name: "admins-can-manage-users",
    description: "Admins can view and manage all users",
    decisionStrategy: "UNANIMOUS",
    scopes: [
        "view",
        "manage",
    ],
    policies: [adminsPolicy.id],
});
const auditorsViewUsers = new keycloak.UsersAdminPermissions("auditors_view_users", {
    realmId: realm.id,
    name: "auditors-can-view-users",
    description: "Auditors can view all users",
    scopes: ["view"],
    policies: [auditorsPolicy.id],
});

import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    admin_permissions_enabled=True)
admin_permissions = keycloak.openid.get_client_output(realm_id=realm.id,
    client_id="admin-permissions")
admins = keycloak.Group("admins",
    realm_id=realm.id,
    name="admins")
auditors = keycloak.Group("auditors",
    realm_id=realm.id,
    name="auditors")
admins_policy = keycloak.openid.ClientGroupPolicy("admins_policy",
    realm_id=realm.id,
    resource_server_id=admin_permissions.id,
    name="admins-policy",
    groups=[{
        "id": admins.id,
        "path": admins.path,
        "extend_children": False,
    }],
    logic="POSITIVE",
    decision_strategy="UNANIMOUS")
auditors_policy = keycloak.openid.ClientGroupPolicy("auditors_policy",
    realm_id=realm.id,
    resource_server_id=admin_permissions.id,
    name="auditors-policy",
    groups=[{
        "id": auditors.id,
        "path": auditors.path,
        "extend_children": False,
    }],
    logic="POSITIVE",
    decision_strategy="UNANIMOUS")
# One permission per logical role — each is a separate Terraform resource.
admins_manage_users = keycloak.UsersAdminPermissions("admins_manage_users",
    realm_id=realm.id,
    name="admins-can-manage-users",
    description="Admins can view and manage all users",
    decision_strategy="UNANIMOUS",
    scopes=[
        "view",
        "manage",
    ],
    policies=[admins_policy.id])
auditors_view_users = keycloak.UsersAdminPermissions("auditors_view_users",
    realm_id=realm.id,
    name="auditors-can-view-users",
    description="Auditors can view all users",
    scopes=["view"],
    policies=[auditors_policy.id])

package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:                   pulumi.String("my-realm"),
			AdminPermissionsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		adminPermissions := openid.LookupClientOutput(ctx, openid.GetClientOutputArgs{
			RealmId:  realm.ID(),
			ClientId: pulumi.String("admin-permissions"),
		}, nil)
		admins, err := keycloak.NewGroup(ctx, "admins", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("admins"),
		})
		if err != nil {
			return err
		}
		auditors, err := keycloak.NewGroup(ctx, "auditors", &keycloak.GroupArgs{
			RealmId: realm.ID(),
			Name:    pulumi.String("auditors"),
		})
		if err != nil {
			return err
		}
		adminsPolicy, err := openid.NewClientGroupPolicy(ctx, "admins_policy", &openid.ClientGroupPolicyArgs{
			RealmId: realm.ID(),
			ResourceServerId: pulumi.String(adminPermissions.ApplyT(func(adminPermissions openid.GetClientResult) (*string, error) {
				return adminPermissions.Id, nil
			}).(pulumi.StringPtrOutput)),
			Name: pulumi.String("admins-policy"),
			Groups: openid.ClientGroupPolicyGroupArray{
				&openid.ClientGroupPolicyGroupArgs{
					Id:             admins.ID(),
					Path:           admins.Path,
					ExtendChildren: pulumi.Bool(false),
				},
			},
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
		})
		if err != nil {
			return err
		}
		auditorsPolicy, err := openid.NewClientGroupPolicy(ctx, "auditors_policy", &openid.ClientGroupPolicyArgs{
			RealmId: realm.ID(),
			ResourceServerId: pulumi.String(adminPermissions.ApplyT(func(adminPermissions openid.GetClientResult) (*string, error) {
				return adminPermissions.Id, nil
			}).(pulumi.StringPtrOutput)),
			Name: pulumi.String("auditors-policy"),
			Groups: openid.ClientGroupPolicyGroupArray{
				&openid.ClientGroupPolicyGroupArgs{
					Id:             auditors.ID(),
					Path:           auditors.Path,
					ExtendChildren: pulumi.Bool(false),
				},
			},
			Logic:            pulumi.String("POSITIVE"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
		})
		if err != nil {
			return err
		}
		// One permission per logical role — each is a separate Terraform resource.
		_, err = keycloak.NewUsersAdminPermissions(ctx, "admins_manage_users", &keycloak.UsersAdminPermissionsArgs{
			RealmId:          realm.ID(),
			Name:             pulumi.String("admins-can-manage-users"),
			Description:      pulumi.String("Admins can view and manage all users"),
			DecisionStrategy: pulumi.String("UNANIMOUS"),
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
				pulumi.String("manage"),
			},
			Policies: pulumi.StringArray{
				adminsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		_, err = keycloak.NewUsersAdminPermissions(ctx, "auditors_view_users", &keycloak.UsersAdminPermissionsArgs{
			RealmId:     realm.ID(),
			Name:        pulumi.String("auditors-can-view-users"),
			Description: pulumi.String("Auditors can view all users"),
			Scopes: pulumi.StringArray{
				pulumi.String("view"),
			},
			Policies: pulumi.StringArray{
				auditorsPolicy.ID(),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        AdminPermissionsEnabled = true,
    });

    var adminPermissions = Keycloak.OpenId.GetClient.Invoke(new()
    {
        RealmId = realm.Id,
        ClientId = "admin-permissions",
    });

    var admins = new Keycloak.Group("admins", new()
    {
        RealmId = realm.Id,
        Name = "admins",
    });

    var auditors = new Keycloak.Group("auditors", new()
    {
        RealmId = realm.Id,
        Name = "auditors",
    });

    var adminsPolicy = new Keycloak.OpenId.ClientGroupPolicy("admins_policy", new()
    {
        RealmId = realm.Id,
        ResourceServerId = adminPermissions.Apply(getClientResult => getClientResult.Id),
        Name = "admins-policy",
        Groups = new[]
        {
            new Keycloak.OpenId.Inputs.ClientGroupPolicyGroupArgs
            {
                Id = admins.Id,
                Path = admins.Path,
                ExtendChildren = false,
            },
        },
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
    });

    var auditorsPolicy = new Keycloak.OpenId.ClientGroupPolicy("auditors_policy", new()
    {
        RealmId = realm.Id,
        ResourceServerId = adminPermissions.Apply(getClientResult => getClientResult.Id),
        Name = "auditors-policy",
        Groups = new[]
        {
            new Keycloak.OpenId.Inputs.ClientGroupPolicyGroupArgs
            {
                Id = auditors.Id,
                Path = auditors.Path,
                ExtendChildren = false,
            },
        },
        Logic = "POSITIVE",
        DecisionStrategy = "UNANIMOUS",
    });

    // One permission per logical role — each is a separate Terraform resource.
    var adminsManageUsers = new Keycloak.UsersAdminPermissions("admins_manage_users", new()
    {
        RealmId = realm.Id,
        Name = "admins-can-manage-users",
        Description = "Admins can view and manage all users",
        DecisionStrategy = "UNANIMOUS",
        Scopes = new[]
        {
            "view",
            "manage",
        },
        Policies = new[]
        {
            adminsPolicy.Id,
        },
    });

    var auditorsViewUsers = new Keycloak.UsersAdminPermissions("auditors_view_users", new()
    {
        RealmId = realm.Id,
        Name = "auditors-can-view-users",
        Description = "Auditors can view all users",
        Scopes = new[]
        {
            "view",
        },
        Policies = new[]
        {
            auditorsPolicy.Id,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.OpenidFunctions;
import com.pulumi.keycloak.openid.inputs.GetClientArgs;
import com.pulumi.keycloak.Group;
import com.pulumi.keycloak.GroupArgs;
import com.pulumi.keycloak.openid.ClientGroupPolicy;
import com.pulumi.keycloak.openid.ClientGroupPolicyArgs;
import com.pulumi.keycloak.openid.inputs.ClientGroupPolicyGroupArgs;
import com.pulumi.keycloak.UsersAdminPermissions;
import com.pulumi.keycloak.UsersAdminPermissionsArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .adminPermissionsEnabled(true)
            .build());

        final var adminPermissions = OpenidFunctions.getClient(GetClientArgs.builder()
            .realmId(realm.id())
            .clientId("admin-permissions")
            .build());

        var admins = new Group("admins", GroupArgs.builder()
            .realmId(realm.id())
            .name("admins")
            .build());

        var auditors = new Group("auditors", GroupArgs.builder()
            .realmId(realm.id())
            .name("auditors")
            .build());

        var adminsPolicy = new ClientGroupPolicy("adminsPolicy", ClientGroupPolicyArgs.builder()
            .realmId(realm.id())
            .resourceServerId(adminPermissions.applyValue(_adminPermissions -> _adminPermissions.id()))
            .name("admins-policy")
            .groups(ClientGroupPolicyGroupArgs.builder()
                .id(admins.id())
                .path(admins.path())
                .extendChildren(false)
                .build())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .build());

        var auditorsPolicy = new ClientGroupPolicy("auditorsPolicy", ClientGroupPolicyArgs.builder()
            .realmId(realm.id())
            .resourceServerId(adminPermissions.applyValue(_adminPermissions -> _adminPermissions.id()))
            .name("auditors-policy")
            .groups(ClientGroupPolicyGroupArgs.builder()
                .id(auditors.id())
                .path(auditors.path())
                .extendChildren(false)
                .build())
            .logic("POSITIVE")
            .decisionStrategy("UNANIMOUS")
            .build());

        // One permission per logical role — each is a separate Terraform resource.
        var adminsManageUsers = new UsersAdminPermissions("adminsManageUsers", UsersAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("admins-can-manage-users")
            .description("Admins can view and manage all users")
            .decisionStrategy("UNANIMOUS")
            .scopes(            
                "view",
                "manage")
            .policies(adminsPolicy.id())
            .build());

        var auditorsViewUsers = new UsersAdminPermissions("auditorsViewUsers", UsersAdminPermissionsArgs.builder()
            .realmId(realm.id())
            .name("auditors-can-view-users")
            .description("Auditors can view all users")
            .scopes("view")
            .policies(auditorsPolicy.id())
            .build());

    }
}

resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      adminPermissionsEnabled: true
  admins:
    type: keycloak:Group
    properties:
      realmId: ${realm.id}
      name: admins
  auditors:
    type: keycloak:Group
    properties:
      realmId: ${realm.id}
      name: auditors
  adminsPolicy:
    type: keycloak:openid:ClientGroupPolicy
    name: admins_policy
    properties:
      realmId: ${realm.id}
      resourceServerId: ${adminPermissions.id}
      name: admins-policy
      groups:
        - id: ${admins.id}
          path: ${admins.path}
          extendChildren: false
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
  auditorsPolicy:
    type: keycloak:openid:ClientGroupPolicy
    name: auditors_policy
    properties:
      realmId: ${realm.id}
      resourceServerId: ${adminPermissions.id}
      name: auditors-policy
      groups:
        - id: ${auditors.id}
          path: ${auditors.path}
          extendChildren: false
      logic: POSITIVE
      decisionStrategy: UNANIMOUS
  # One permission per logical role — each is a separate Terraform resource.
  adminsManageUsers:
    type: keycloak:UsersAdminPermissions
    name: admins_manage_users
    properties:
      realmId: ${realm.id}
      name: admins-can-manage-users
      description: Admins can view and manage all users
      decisionStrategy: UNANIMOUS
      scopes:
        - view
        - manage
      policies:
        - ${adminsPolicy.id}
  auditorsViewUsers:
    type: keycloak:UsersAdminPermissions
    name: auditors_view_users
    properties:
      realmId: ${realm.id}
      name: auditors-can-view-users
      description: Auditors can view all users
      scopes:
        - view
      policies:
        - ${auditorsPolicy.id}
variables:
  adminPermissions:
    fn::invoke:
      function: keycloak:openid:getClient
      arguments:
        realmId: ${realm.id}
        clientId: admin-permissions

pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

data "keycloak_openid_getclient" "adminPermissions" {
  realm_id  = keycloak_realm.realm.id
  client_id = "admin-permissions"
}

resource "keycloak_realm" "realm" {
  realm                     = "my-realm"
  admin_permissions_enabled = true
}
resource "keycloak_group" "admins" {
  realm_id = keycloak_realm.realm.id
  name     = "admins"
}
resource "keycloak_group" "auditors" {
  realm_id = keycloak_realm.realm.id
  name     = "auditors"
}
resource "keycloak_openid_clientgrouppolicy" "admins_policy" {
  realm_id           = keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_getclient.adminPermissions.id
  name               = "admins-policy"
  groups {
    id              = keycloak_group.admins.id
    path            = keycloak_group.admins.path
    extend_children = false
  }
  logic             = "POSITIVE"
  decision_strategy = "UNANIMOUS"
}
resource "keycloak_openid_clientgrouppolicy" "auditors_policy" {
  realm_id           = keycloak_realm.realm.id
  resource_server_id = data.keycloak_openid_getclient.adminPermissions.id
  name               = "auditors-policy"
  groups {
    id              = keycloak_group.auditors.id
    path            = keycloak_group.auditors.path
    extend_children = false
  }
  logic             = "POSITIVE"
  decision_strategy = "UNANIMOUS"
}
# One permission per logical role — each is a separate Terraform resource.
resource "keycloak_usersadminpermissions" "admins_manage_users" {
  realm_id          = keycloak_realm.realm.id
  name              = "admins-can-manage-users"
  description       = "Admins can view and manage all users"
  decision_strategy = "UNANIMOUS"
  scopes            = ["view", "manage"]
  policies          = [keycloak_openid_clientgrouppolicy.admins_policy.id]
}
resource "keycloak_usersadminpermissions" "auditors_view_users" {
  realm_id    = keycloak_realm.realm.id
  name        = "auditors-can-view-users"
  description = "Auditors can view all users"
  scopes      = ["view"]
  policies    = [keycloak_openid_clientgrouppolicy.auditors_policy.id]
}

var usersAdminPermissionsResource = new Keycloak.UsersAdminPermissions("usersAdminPermissionsResource", new()
{
    RealmId = "string",
    Scopes = new[]
    {
        "string",
    },
    DecisionStrategy = "string",
    Description = "string",
    Name = "string",
    Policies = new[]
    {
        "string",
    },
});

example, err := keycloak.NewUsersAdminPermissions(ctx, "usersAdminPermissionsResource", &keycloak.UsersAdminPermissionsArgs{
	RealmId: pulumi.String("string"),
	Scopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DecisionStrategy: pulumi.String("string"),
	Description:      pulumi.String("string"),
	Name:             pulumi.String("string"),
	Policies: pulumi.StringArray{
		pulumi.String("string"),
	},
})

resource "keycloak_users_admin_permissions" "usersAdminPermissionsResource" {
  lifecycle {
    create_before_destroy = true
  }
  realm_id          = "string"
  scopes            = ["string"]
  decision_strategy = "string"
  description       = "string"
  name              = "string"
  policies          = ["string"]
}

var usersAdminPermissionsResource = new UsersAdminPermissions("usersAdminPermissionsResource", UsersAdminPermissionsArgs.builder()
    .realmId("string")
    .scopes("string")
    .decisionStrategy("string")
    .description("string")
    .name("string")
    .policies("string")
    .build());

users_admin_permissions_resource = keycloak.UsersAdminPermissions("usersAdminPermissionsResource",
    realm_id="string",
    scopes=["string"],
    decision_strategy="string",
    description="string",
    name="string",
    policies=["string"])

const usersAdminPermissionsResource = new keycloak.UsersAdminPermissions("usersAdminPermissionsResource", {
    realmId: "string",
    scopes: ["string"],
    decisionStrategy: "string",
    description: "string",
    name: "string",
    policies: ["string"],
});

type: keycloak:UsersAdminPermissions
properties:
    decisionStrategy: string
    description: string
    name: string
    policies:
        - string
    realmId: string
    scopes:
        - string