keycloak-documentation | Open Source Identity and Access Management | Identity Management library

You need to the following:

If your keycloak client is confidential then you can create an access token using client_id and client_secret and if your client is public then you can generate an access token using OAuth code grant flow

You can create an access token using the token end point.

Sample cURL :

You can get the Client's role and attribute by API call. GET /{realm}/clients/{id}/roles/{role-name}

Example for)

There are a couple of requirements. #1 User(agency_user) should assigned two roles(manage-realm, view-clients) in Keyclaok UI

#2 get access token by API and save into Postman variable http://127.0.0.1:8080/auth/realms/test/protocol/openid-connect/token Client id & secret get from Keyclaok UI as attached

#3 You should know the client ID by GET client API using #1 access token http://127.0.0.1:8080/auth/admin/realms/test/clients

More detail information, Good Luck! https://www.keycloak.org/docs-api/11.0/rest-api/index.html#_roles_resource

Please check the version of KeyCloak adapters you are using. The adapters for version 7 of Tomcat differ from those for Tomcat versions 8 and 9.

If we compare the two adapter modules from KeyCloak for Tomcat 8,9 against the ones for Tomcat 7 we see that the module from Tomcat 7 does not override or implement FormAuthenticator.doAuthenticate. So if that module for Tomcat 7 is called from Tomcat 8 it will call the parents doAuthenticate method and attempt form-based authentication.