无法在客户端创建时设置view_users角色。
它可以在创建后通过单独的API（客户端角色Map）进行分配

curl --location --request POST 'http://localhost:8180/auth/admin/realms/$REALM_NAME/users/$SERVICE_ACCOUNT_USER_ID/role-mappings/clients/$REALM_MANAGEMENT_CLIENT_ID' \
--header 'Authorization: Bearer $MASTER_TOKEN' \
--header 'Content-Type: application/json' \
--data-raw '[
    {
        "id":$VIEW_USER_ID,
        "name":"view-users",
        "description":"${role_view-users}",
        "composite":true,
        "clientRole":true,
        "containerId":$REALM_MANAGEMENT_CLIENT_ID
    }
]'

此API需要三项。

$SERVICE_ACCOUNT_USER_ID
$REALM_MANAGEMENT_CLIENT_ID
$VIEW_USER_ID

演示步骤

我正在使用Keycloak v18.0.2，curl，jq和git bash terminal，Windows 10
(It在linux中也没有问题）
因此，所有捕获的图像都将遵循curl命令。
步骤3和7是关键步骤

我将演示curl的所有API调用

#1设置{凭证、客户端名称、域名}

MASTER_USERNAME=admin
MASTER_PASSWORD=admin
REALM_NAME=my-realm
CLIENT_NAME=demo
echo '$MASTER_USERNAME = '$MASTER_USERNAME
echo 'MASTER_PASSWORD = '$MASTER_PASSWORD
echo 'REALM_NAME = '$REALM_NAME
echo 'CLIENT_NAME= '$CLIENT_NAME

#2获取主令牌

更多细节在这里

MASTER_TOKEN_URL=$(curl --location --request GET 'http://localhost:8180/auth/realms/master/.well-known/openid-configuration' | jq -r '.token_endpoint')
echo $MASTER_TOKEN_URL

MASTER_TOKEN=$(curl --location --request POST "$MASTER_TOKEN_URL" \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id=admin-cli' \
--data-urlencode 'username='$MASTER_USERNAME \
--data-urlencode 'password='$MASTER_PASSWORD \
--data-urlencode 'grant_type=password' | jq -r '.access_token')
echo 'MASTER_TOKEN = '$MASTER_TOKEN

#3创建客户端

curl --location --request POST 'http://localhost:8180/auth/admin/realms/'$REALM_NAME'/clients' \
--header 'Authorization: Bearer '$MASTER_TOKEN \
--header 'Content-Type: application/json' \
--data-raw '{
    "clientId":"'$CLIENT_NAME'",
    "enabled":true,
    "consentRequired": false,
    "attributes":{},
    "serviceAccountsEnabled": true,
    "protocol":"openid-connect",
    "publicClient":false,
    "authorizationServicesEnabled": true,
    "clientAuthenticatorType":"client-secret",
    "redirectUris":["http://localhost:8180/demo"]
}'

#4获取{service-account-user-id}

SERVICE_ACCOUNT_USER_ID=$(curl --location --request GET 'http://localhost:8180/auth/admin/realms/'$REALM_NAME'/users/?username=service-account-'$CLIENT_NAME \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r .[0].id)
echo 'SERVICE_ACCOUNT_USER_ID = '$SERVICE_ACCOUNT_USER_ID

#5获取{realm-management-client-id}

REALM_MANAGEMENT_CLIENT_ID=$(curl --location --request GET 'http://localhost:8180/auth/admin/realms/'$REALM_NAME'/clients' \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r '. | map(select(.clientId == "realm-management")) | .[0].id')
echo 'REALM_MANAGEMENT_CLIENT_ID = '$REALM_MANAGEMENT_CLIENT_ID

#6获取{view_user_role_id}

VIEW_USERS_ID=$(curl --location --request GET 'http://localhost:8180/auth/admin/realms/'$REALM_NAME'/clients/'$REALM_MANAGEMENT_CLIENT_ID'/roles' \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq -r '. | map(select(.name == "view-users")) | .[0].id')
echo 'VIEW_USERS_ID = '$VIEW_USERS_ID

#7为客户端分配view-users角色

curl --location --request POST 'http://localhost:8180/auth/admin/realms/'$REALM_NAME'/users/'$SERVICE_ACCOUNT_USER_ID'/role-mappings/clients/'$REALM_MANAGEMENT_CLIENT_ID \
--header 'Authorization: Bearer '$MASTER_TOKEN \
--header 'Content-Type: application/json' \
--data-raw '[
    {
        "id":"'$VIEW_USERS_ID'",
        "name":"view-users",
        "description":"${role_view-users}",
        "composite":true,
        "clientRole":true,
        "containerId":"'$REALM_MANAGEMENT_CLIENT_ID'"
    }
]'

#8确认

最后可以通过curl或者UI来确认

curl --location --request GET 'http://localhost:8180/auth/admin/realms/my-realm/users/'$SERVICE_ACCOUNT_USER_ID'/role-mappings/clients/'$REALM_MANAGEMENT_CLIENT_ID \
--header 'Authorization: Bearer '$MASTER_TOKEN | jq --indent 4