Skip to content
Documentation
Using
Resources
Service Accounts

Service Accounts

Use these resources when a client needs to authenticate as itself for machine-to-machine access. They assign realm or client roles to a client’s service account. The client must have serviceAccountsEnabled: true.

API Reference

KindAPI GroupTerraform ResourceCRD Explorer
ClientServiceAccountRealmRoleopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_service_account_realm_roleView CRD Schema
ClientServiceAccountRoleopenidclient.keycloak.crossplane.io/v1alpha1keycloak_openid_client_service_account_roleView CRD Schema

Working YAML Examples

ClientServiceAccountRealmRole 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientServiceAccountRealmRole
metadata:
  name: service-account-realm-role
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    realmId: "dev"
    role: "svc-realm-role"
    serviceAccountUserClientIdRef:
      name: "service-acc-1"
      policy:
        resolve: Always

ClientServiceAccountRole 

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientServiceAccountRole
metadata:
  name: service-account-role
spec:
  providerConfigRef:
    name: "keycloak-provider-config"
  deletionPolicy: Delete
  forProvider:
    clientIdRef:
      name: "test"
      policy:
        resolve: Always
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    roleRef:
      name: "svc-role"
      policy:
        resolve: Always
    serviceAccountUserClientIdRef:
      name: "service-acc-1"
      policy:
        resolve: Always

Related Resources

SAML ClientsUser Federation