# 403 Error while getting KeycloakAdmin using python-keycloak

**URL:** <https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301>\
**Category:** Miscellanaeous\
**Created:** [February 17, 2023, 2:47pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301 "2023-02-17T14:47:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jason1](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@Jason1](https://forum.keycloak.org/u/Jason1)\
**Post date:** [February 17, 2023, 2:47pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/1 "2023-02-17T14:47:06Z")

</div>

```auto
ka = KeycloakAdmin(server_url={$ENDPOINT},
                                  username='myuser',
                                  password='mypwd',
                                  realm_name='master',
                                  client_id='admin-cli',
                                  verify=False)                                   

```

I get the following error:

keycloak.exceptions.KeycloakPostError: 403: b’

# 403 Forbidden
\nRequest forbidden by administrative rules.\n\n’

---

<div class="post-metadata">

**Author:** ![Jason1](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@Jason1](https://forum.keycloak.org/u/Jason1)\
**Post date:** [February 17, 2023, 4:43pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/2 "2023-02-17T16:43:50Z")

</div>

I could now get past this error but the I get another. First here is how I got past the error:

```auto
ka = KeycloakAdmin(server_url={$ENDPOINT},
                                  username='myuser',
                                  password='mypwd',
                                  user_realm_name='myrealm',
                                  client_id='myclient1',
                                  client_secret_key={$CLIENT_SECRET}
                                  verify=False) 

```

But now when I try to do:

```auto
realm_roles = ka.get_realm_roles()

```

I get:

error\_message=message, response\_code=response.status\_code, response\_body=response.content  
keycloak.exceptions.KeycloakGetError: 403: b’{“error”:“unknown\_error”}’

Not a very good error message.

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [February 17, 2023, 5:39pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/3 "2023-02-17T17:39:56Z")

</div>

403 is authorization related. I believe the user has to have `view-realm` in order to see realm roles.

Also, you’re using both username/password and client id/secret. You’ll want to pick one, either `password` grant type or `client_credentials` grant type. I’d suggest starting with the `admin-cli` client id, and using your admin username/password.

---

<div class="post-metadata">

**Author:** ![Jason1](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@Jason1](https://forum.keycloak.org/u/Jason1)\
**Post date:** [February 17, 2023, 6:53pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/4 "2023-02-17T18:53:06Z")

</div>

OK thanks. I tried it and am now getting:

keycloak.exceptions.KeycloakAuthenticationError: 401: b’{“error”:“invalid\_grant”,“error\_description”:“Invalid user credentials”}’

But I am using the same credentials I log in with. Also how would I go about adding view-realm to the user. I did not see that option in the admin console?

---

<div class="post-metadata">

**Author:** ![xgp](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/xgp/32/2589_2.png) [@xgp](https://forum.keycloak.org/u/xgp)\
**Post date:** [February 17, 2023, 7:55pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/5 "2023-02-17T19:55:35Z")

</div>

Setup should look like this:

```python
keycloak_admin = KeycloakAdmin(server_url="https://my-keycloak-host/auth/",
                               username='admin',
                               password='password',
                               realm_name=realm,
                               client_id='admin-cli',
                               verify=True)

```

Granting `realm-management` roles can be done in the “Role Mappings” tab of the user (selecting “Filter by clients” in the modal):

 ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/c8b46f44ec278be3f5a6b0ab3f1b69719df58597.png)

---

<div class="post-metadata">

**Author:** ![Jason1](https://avatars.discourse-cdn.com/v4/letter/j/b19c9b/32.png) [@Jason1](https://forum.keycloak.org/u/Jason1)\
**Post date:** [February 17, 2023, 9:46pm UTC](https://forum.keycloak.org/t/403-error-while-getting-keycloakadmin-using-python-keycloak/20301/6 "2023-02-17T21:46:49Z")

</div>

I got it working. I was using an admin user and password from the master realm but I was logging into a different realm. Thanks for your help.