I have a web application that is leveraging Keycloak for IdM.
I am using the Resource Owner Password Credentials or Direct Grant flow for authentication which uses REST API calls to /auth/realms/{realm}/protocol/openid-connect/token
instead of browser redirects to get the user a JWT.
I would like to implement a similar workflow for signing users up.
Looking at the Keycloak documentation it appears the Keycloak Admin API exposes an endpoint for this at /auth/admin/realms/{realm}/users.
To allow clients to interact with the Keycloak Admin API you have to create a client service account and associate it with a keycloak role with sufficient privilege to manage realm users.
The expected approach for this seems to be to apply the manage-users realm specific role to the client service account. This is more permissions than I would like to grant to the client.
Is there a way to grant a client service account just the ability to create new users and not the full set of permissions that comes with manage-users?