title: Access Keycloak REST Admin API using a service account (client credential grant)
body: <p>I like to manage keycloak from my own application:create user &amp; clients, display users &amp; client. As this is not a real user but a machine I would like to use a service account with a client credential grant as proposed in <a href="https://stackoverflow.com/questions/46470477/how-to-get-keycloak-users-via-rest-without-admin-account">How to get Keycloak users via REST without admin account</a> . To realize this I: </p>
  
  <ol>
  <li>create a realm </li>
  <li>inside the real created a client </li>
  <li>configured the access type of the client to "confidential" saved and activated the "Service Accounts Enabled" option that will apear after the save. </li>
  <li><p>enable under scopes the client-roles of the "real-management" (see screenshot) 
  <a href="https://i.stack.imgur.com/z12Os.png" rel="noreferrer"><img src="https://i.stack.imgur.com/z12Os.png" alt="enter image description here"></a></p></li>
  <li><p>requested an access token with the "username:password" base64 encoded in the header
  <code>
  curl -X POST 'http://accounts.d10l.de/auth/realms/d10l/protocol/openid-connect/token' \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Authorization: Basic ZGV2ZWxvcGVyLXBvcnRhbDpmZGRmYzM4Yy05MzAyLTRlZmQtYTM3Yy1lMWFmZGEyMmRhMzc=" \
  -d 'grant_type=client_credentials' \
  | jq -r '.access_token'
  </code></p></li>
  <li>Try to access the users using the access token: </li>
  </ol>
  
  <p><code>
  curl -I GET 'http://accounts.d10l.de/auth/admin/realms/d10l/users/' \
  -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIxRVdoNENFUjIweDY5SlBCekU4dU9GdXF4R2NVNlVfWmpTNTQ5bmd2QjNjIn0.eyJqdGkiOiI0NDM0ZDFhNS0xZTA5LTQ4MzQtYWI2Yy0zOTk1YmEwMTgxMzAiLCJleHAiOjE1MzY0MzYwMDEsIm5iZiI6MCwiaWF0IjoxNTM2NDM1NzAxLCJpc3MiOiJodHRwOi8vYWNjb3VudHMuZDEwbC5kZS9hdXRoL3JlYWxtcy9kMTBsIiwiYXVkIjoiZGV2ZWxvcGVyLXBvcnRhbCIsInN1YiI6IjliYWI0YWM1LTRiNWMtNGIxOS05ZTc3LWFjOWFmNzlkNzFhZiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImRldmVsb3Blci1wb3J0YWwiLCJhdXRoX3RpbWUiOjAsInNlc3Npb25fc3RhdGUiOiIyOWM2YWI3Mi05N2RiLTQ2NWUtYTE1Yy03ZWE5NzA0NmZlYzQiLCJhY3IiOiIxIiwiYWxsb3dlZC1vcmlnaW5zIjpbXSwicmVzb3VyY2VfYWNjZXNzIjp7fSwic2NvcGUiOiJlbWFpbCBwcm9maWxlIiwiY2xpZW50SWQiOiJkZXZlbG9wZXItcG9ydGFsIiwiY2xpZW50SG9zdCI6IjE3Mi4xNy4wLjEiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6InNlcnZpY2UtYWNjb3VudC1kZXZlbG9wZXItcG9ydGFsIiwiY2xpZW50QWRkcmVzcyI6IjE3Mi4xNy4wLjEiLCJlbWFpbCI6InNlcnZpY2UtYWNjb3VudC1kZXZlbG9wZXItcG9ydGFsQHBsYWNlaG9sZGVyLm9yZyJ9.D_XnpF1rwCayup8h4UXM4AGWkY_xQo40X-yIlWhmqaxkVh1FQy24932VDRCAmxYHcrwazRMqO7snXmre3_8YF5R9Dt8GYjiBorECvQ9X_nBwunmHqnGxIeE64c2GXiz6zSjdgQJQE8fH10NsLyFWHQ-lBPsBwZBsrkKQ5QUEU2qjE7rDRPtYLJPB94BSE4QGfedmRIbvg39snVkClBDUmuBTq_Rc4p7kV69h0a2Mb1sgEr3MdB4RcsOe3gJPZVVtu7gZuGqcAQKMYgtybArF3OXz37w8hjUp6FABxDcvY7K-jsGxXn0hSU0OB7wxAWY9vP4ar4tQYlKxNjs46rPLWw"
  </code></p>
  
  <p>But the response is a 403:</p>
  
  <p><code>
  url: (6) Could not resolve host: GET
  HTTP/1.1 403 Forbidden
  content-length: 0
  date: Sat, 08 Sep 2018 19:42:06 GMT
  </code></p>
  
  <p>How/Is it possible accessing the Admin REST API from a new service account through a client credential grant? </p>