Inject client secrets from a local file into a Keycloak Realm Export (JSON) file

set-keycloak-client-secret.groovy

import groovy.json.JsonSlurper
import groovy.json.JsonOutput

def jsonSlurper = new JsonSlurper()
def secrets = jsonSlurper.parse(new File(args[1] ?: "secrets.json")).clients.inject([:]) { map, c -> map[c.client] = c.secret; map } 

def realm = jsonSlurper.parse(new File(args[0]))

for(client in realm.clients) {
  if(secrets[client.clientId]) {
    client.secret = secrets[client.clientId]
  }
}

def output = JsonOutput.toJson(realm)
def json = JsonOutput.prettyPrint(output)

println json

Keycloak does not export client secrets, but it can import them. So if you need to import a realm with known secrets you can export the realm first, then use this groovy script to replace ********** in the json file with secrets from a secrets.json file that you prepared.

Example secrets.json

{
  "clients": [
    { "client": "customer-service", "secret": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" },
    { "client": "book-service", "secret": "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy" }
  ]
}

Usage: groovy set-keycloak-client-secret.groovy realm-export.json secrets.json > realm-export-new.json

Thanks goeh, you saved my day !!! Really cool idea.

Thanks, very cool