Authors and runs integration tests against Keycloak - uses Testcontainers Keycloak module to spin up an isolated server per test class, imports realm JSON for fixtures, exercises OIDC discovery / token endpoint / token introspection / admin REST API; tests password / authorization-code / client-credentials / token-exchange flows; covers UMA (User-Managed Access) permission tickets. Use when the user works with self-hosted Keycloak and needs unit / integration tests for realms, clients, users, or auth flows.
67
84%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Passed
No findings from the security scan
Additional endpoint patterns beyond the core token endpoint: token introspection for resource servers, and provisioning through the Admin REST API.
For RP (Resource Provider) integration:
def test_token_introspection(keycloak, access_token):
response = requests.post(
f"{keycloak.get_url()}/realms/test/protocol/openid-connect/token/introspect",
auth=("test-client", "test-secret"),
data={"token": access_token},
)
assert response.status_code == 200
body = response.json()
assert body["active"] is True
assert "username" in body
assert "preferred_username" in bodyKeycloak exposes its admin functionality via REST. Pattern: obtain an admin-realm token, then call the admin endpoints:
def test_create_user_via_admin_api(keycloak):
admin_token = get_admin_token(keycloak)
response = requests.post(
f"{keycloak.get_url()}/admin/realms/test/users",
headers={"Authorization": f"Bearer {admin_token}"},
json={
"username": "newuser",
"enabled": True,
"credentials": [{"type": "password", "value": "newpass", "temporary": False}],
},
)
assert response.status_code == 201