Import from Keycloak

--from keycloak reads a realm directly from a running Keycloak instance through its Admin REST API and recreates it in FerrisKey.

ferris-ctl realm import --from keycloak \
  --source-url https://keycloak.example.com \
  --source-realm acme \
  --source-client-id admin-cli \
  --source-client-secret "$KC_SECRET" \
  --target-realm acme

Required flags

Flag	Description
`--source-url`	Base URL of the Keycloak instance
`--source-realm`	Realm to read from Keycloak

Authentication

Two options:

Client credentials: pass --source-client-id and --source-client-secret, and the CLI runs a client-credentials grant against the source realm’s token endpoint.
A ready token: pass --source-token when you already have a bearer token in hand.

When --source-token is set, the client id and secret are ignored.

ferris-ctl source add kc-prod --kind keycloak \
  --url https://keycloak.example.com --realm acme \
  --client-id admin-cli --client-secret "$KC_SECRET"

ferris-ctl realm import --source-ref kc-prod --target-realm acme

What gets imported

The importer reads, from /admin/realms/{realm}:

realm settings, mapped onto the FerrisKey realm settings it has an equivalent for
clients, with their redirect URIs and flags
the roles of each client
realm roles
users, paged 100 at a time

What does not come across

Keycloak never exports password hashes, so users arrive without credentials.

Role mappings per user are not imported either. The roles themselves are created, but who holds them is not carried over.

Go through the imported realm afterwards and re-establish credentials and role assignments.

Run --dry-run -o yaml first to see precisely what would be created.