Authors and runs integration tests against Keycloak - uses Testcontainers Keycloak module to spin up an isolated server per test class, imports realm JSON for fixtures, exercises OIDC discovery / token endpoint / token introspection / admin REST API; tests password / authorization-code / client-credentials / token-exchange flows; covers UMA (User-Managed Access) permission tickets. Use when the user works with self-hosted Keycloak and needs unit / integration tests for realms, clients, users, or auth flows.
75
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Additional endpoint patterns beyond the core token endpoint: token introspection for resource servers, and provisioning through the Admin REST API.
For RP (Resource Provider) integration:
def test_token_introspection(keycloak, access_token):
response = requests.post(
f"{keycloak.get_url()}/realms/test/protocol/openid-connect/token/introspect",
auth=("test-client", "test-secret"),
data={"token": access_token},
)
assert response.status_code == 200
body = response.json()
assert body["active"] is True
assert "username" in body
assert "preferred_username" in bodyKeycloak exposes its admin functionality via REST. Pattern: obtain an admin-realm token, then call the admin endpoints:
def test_create_user_via_admin_api(keycloak):
admin_token = get_admin_token(keycloak)
response = requests.post(
f"{keycloak.get_url()}/admin/realms/test/users",
headers={"Authorization": f"Bearer {admin_token}"},
json={
"username": "newuser",
"enabled": True,
"credentials": [{"type": "password", "value": "newpass", "temporary": False}],
},
)
assert response.status_code == 201