Cannot manage authorization settings (scopes, resources, policies, permissions) through KeycloakClient CRD about keycloak-operator

[andreaTP]

Hi @krlm ,

thanks for reaching out and sorry for the late answer.
Unfortunately sync of the client resource is not supported by this operator and the suggested way is always to delete and recreate those resources.

[vmuzikar]

@andreaTP Do you think we can close this as it is now documented?

[andreaTP]

@vmuzikar let's close it and re-open it if necessary.

[krlm]

Hi @andreaTP,
Thanks for reply. I get that it's a limitation of KeyCloak API not operator itself? Proposed approach manifested a problem in our setup, offline tokens are generated per clientId so when client configuration is "recreated" and client gets new ID then offline tokens cannot be used to obtain fresh access tokens.

{"error":"invalid_grant","error_description":"Session doesn't have required client"}