It s not exactly the topic but I needed to find the roles associated with a specific user and this question pops first with my keywords web search. Here s what worked for me with keycloak client 13.0.1 RealmResource realmResource = keycloak.realm(REALM); UsersResource usersResource = realmResource.users(); UserResource userResource = usersResource.get(USER_ID); RoleMappingResource roleMappingResource = userResource.roles(); // either realmLevel or clientLevel RoleScopeResource roleScopeResource = roleMappingResource.realmLevel(); List rolesRepresentation = roleScopeResource.listAll(); I didn t find it elsewhere, I hope it can be useful.

How to get all users of a certain client by a certain role like all admins ? Note that for client roles you must use the client s internal ID, not the name of the client! package com.audija.admin.service.security; import com.audija.admin.controller.EmailsController; import com.audija.admin.security.KeycloakConfig; import com.audija.admin.util.Role; import org.keycloak.admin.client.resource.*; import org.keycloak.representations.idm.ClientRepresentation; import org.keycloak.representations.idm.RoleRepresentation; import org.keycloak.representations.idm.UserRepresentation; import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Service; import org.springframework.transaction.annotation.Transactional; import java.util.*; import java.util.concurrent.Executors; import java.util.concurrent.ScheduledExecutorService; import java.util.concurrent.TimeUnit; import java.util.concurrent.atomic.AtomicInteger; import java.util.logging.Logger; import java.util.stream.Collectors; @Service public class KeycloakService { private static final Logger logger = Logger.getLogger(EmailsController.class.getName()); private final String publicClientId; public KeycloakService(@Value("${keycloak.resource}") String publicClientId) { this.publicClientId = publicClientId; } private RealmResource getRealmResource() { return KeycloakConfig.GLOBAL_KEYCLOAK_INSTANCE.realm(KeycloakConfig.REALM); } @Transactional public List < UserRepresentation > getAdmins() { List < UserRepresentation > admins = new ArrayList < > (); logger.info("Start fetching admins ..."); long totalStartTime = System.currentTimeMillis(); try { admins = fetchUsers(); } catch (Exception exc) { logger.info(String.format(" ✗ Failed to fetch admins: %s", exc.getMessage())); throw new RuntimeException("Failed to fetch admins", exc); } finally { long totalEndTime = System.currentTimeMillis(); logger.info(String.format("✓ Fetched %d admins", admins.size())); logger.info(String.format("Total fetch time: %.2f seconds", (totalEndTime - totalStartTime) / 1000.0)); } return admins; } private List < UserRepresentation > fetchUsers() { RealmResource realmResource = getRealmResource(); ClientRepresentation client = realmResource.clients().findByClientId(publicClientId).getFirst(); // Define your role name here. RoleResource role = realmResource.clients().get(client.getId()).roles().get(Role.admin.name()); return role.getUserMembers(0, Integer.MAX_VALUE); } } Keycloak Version: 22.0.5 Spring Boot Version: 3.3.0