kcadm

What it does

How to write it

kcadm.sh COMMAND ENDPOINT [-r REALM] [-s key=value ...] [ARGS]

Main parts

Commands

config credentials

Log in to the server.

create ENDPOINT

Create (realms, users, clients, roles).

get ENDPOINT

Read.

update ENDPOINT

Change.

delete ENDPOINT

Delete.

set-password

Set a user password.

add-roles / remove-roles

Give or take roles.

get-roles

Show roles.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Run Keycloak in a container for the lab

   $podman run -d --name keycloak -p 8080:8080 -e KC_BOOTSTRAP_ADMIN_USERNAME=admin -e KC_BOOTSTRAP_ADMIN_PASSWORD=ChangeMe! quay.io/keycloak/keycloak:26.0 start-dev

2. 2Log in with the CLI

   $podman exec -it keycloak bash
   $/opt/keycloak/bin/kcadm.sh config credentials --server http://localhost:8080 --realm master --user admin

3. 3Create a realm with brute-force protection

   $kcadm.sh create realms -s realm=lab -s enabled=true -s bruteForceProtected=true -s 'passwordPolicy="length(12) and notUsername"'

4. 4Create a user and set a password

   $kcadm.sh create users -r lab -s username=hosam -s enabled=true -s email=hosam.test@example.com
   $kcadm.sh set-password -r lab --username hosam --new-password 'Temp-Pass-2026!' --temporary

5. 5Create an OIDC client for Grafana

   $kcadm.sh create clients -r lab -s clientId=grafana -s protocol=openid-connect -s publicClient=false -s 'redirectUris=["https://grafana.lab.local/login/generic_oauth"]' -i

6. 6Read the client secret

   $kcadm.sh get clients -r lab -q clientId=grafana --fields id
   $kcadm.sh get clients/3f2a91c0-1d2e-4f5a-9b8c-7d6e5f4a3b2c/client-secret -r lab

7. 7Create a group and a role, give the role

   $kcadm.sh create groups -r lab -s name=sre
   $kcadm.sh create roles -r lab -s name=admin
   $kcadm.sh add-roles -r lab --uusername hosam --rolename admin

8. 8Require OTP for all users

   $kcadm.sh update authentication/required-actions/CONFIGURE_TOTP -r lab -s defaultAction=true

9. 9List users

   $kcadm.sh get users -r lab --fields username,enabled,email

10. 10Check the OIDC discovery document

    $curl -s http://localhost:8080/realms/lab/.well-known/openid-configuration | jq '.issuer, .token_endpoint'

11. 11Export a realm for Git (in the container)

    $/opt/keycloak/bin/kc.sh export --dir /tmp/export --realm lab

Nothing matches this filter.

Files

~/.keycloak/kcadm.config

CLI login token.

Exit codes