title: Grant a Keycloak client service account permissions to create realm users without using the broad manage-users role
body: <p>I have a web application that is leveraging Keycloak for IdM. </p>
  
  <p>I am using the  <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#flows" rel="noreferrer">Resource Owner Password Credentials</a> or Direct Grant flow for authentication which uses REST API calls to <code>/auth/realms/{realm}/protocol/openid-connect/token</code> instead of browser redirects to get the user a JWT.</p>
  
  <p>I would like to implement a similar workflow for signing users up.</p>
  
  <p>Looking at the Keycloak documentation it appears the Keycloak Admin API exposes an endpoint for this at <a href="https://www.keycloak.org/docs-api/6.0/rest-api/index.html#_users_resource" rel="noreferrer">/auth/admin/realms/{realm}/users</a>.</p>
  
  <p>To allow clients to interact with the Keycloak Admin API you have to create a <a href="https://www.keycloak.org/docs/6.0/server_admin/index.html#_service_accounts" rel="noreferrer">client service account</a> and associate it with a keycloak role with sufficient privilege to manage realm users.</p>
  
  <p>The expected approach for this seems to be to apply the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#realm-specific-roles" rel="noreferrer">manage-users</a> realm specific role to the client service account. This is more permissions than I would like to grant to the client.</p>
  
  <p>Is there a way to grant a client service account <em>just</em> the ability to create new users and not the full set of permissions that comes with manage-users?</p>