Can't create composite roles in Keycloak using Admin REST Api - json

Question

I'm attempting to manage roles and composites programmatically in my Keycloak 6.0.1 system using the Admin REST API. According to the documentation, this is what I want to be using:
https://www.keycloak.org/docs-api/6.0/rest-api/index.html#_roles_resource
Right off the bat, my base URL for Keycloak's API seems to be:
https://example.com/auth/admin
instead of /auth, as the docs seem to suggest. If I use the base URL specified in the docs I get a 404. I discovered this alternate URL structure by inspecting what the Kubernetes admin page was doing when I manage the installation through my browser.
In any case, I am now successfully creating roles using the POST /{realm}/clients/{id}/roles endpoint. Problems begin when I try to add a composite using POST /{realm}/clients/{id}/roles/{role-name}/composites with a POST like this:
/auth/admin/realms/REDACTED/clients/546052d9-6ba1-483e-93a5-a5fda51505b8/roles/%5ECouponAttemptsLog%25Unowned%25Write/composites
authorization: Bearer REDACTED
Content-Type: application/json
Accept: */*
Content-Length: 217
User-Agent: node-fetch/1.0 (+https://github.com/bitinn/node-fetch)
Accept-Encoding: gzip,deflate
Connection: close
Host: REDACTED
{"roles":[{"name":"^CouponAttemptsLog/id%Unowned%Write"},{"name":"^CouponAttemptsLog/code%Unowned%Write"},{"name":"^CouponAttemptsLog/eventId%Unowned%Write"},{"name":"^CouponAttemptsLog/attemptedDate%Unowned%Write"}]}
The error message logged by Keycloak is:
14:18:02,617 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-4884) Uncaught server error: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize instance of `java.util.ArrayList` out of START_OBJECT token
...and Keycloak returns a 500 response with no text.
As far as I can tell, this matches the expected request shape specified in the Keycloak 6 API documentation, and I'm at a loss for what could be causing this deserialization failure. Just for yuks, I tried sending in a naked JSON array as the body, with no improvement.
What am I doing wrong? I understand that the error from Keycloak means it's trying to convert something to an ArrayList which can't be, but I'm at a loss to figure out what and why.

Answer 1

It wants an array of role objects. Try this:
[
{
"name": "^CouponAttemptsLog/id%Unowned%Write"
},
{
"name": "^CouponAttemptsLog/code%Unowned%Write"
},
{
"name": "^CouponAttemptsLog/eventId%Unowned%Write"
},
{
"name": "^CouponAttemptsLog/attemptedDate%Unowned%Write"
}
]
Glancing at the code, I think you'll need to include a role id in addition the name...even if the doc says all fields within RoleRepresentation are optional.

Answer 2

I don't know if you solved your problem but in my case I need to use both id and name while assigning roles to composite role. And yes "partial" roles need to be created before assignment to composite role.
[
{
"id": UUID of created role
"name": "^CouponAttemptsLog/id%Unowned%Write"
}
]
Flow in my looks like this:
In a loop create partial role(s) - Keycloak api return location of new role in headers so you need to call GET to obtain role's json
Push {"id": UUID} to array - or even better {"id": UUID, "name": name } or whole role's representation (to call composites id is enough but in case of service roles you need both
Create composite role
Call composites endpoint