Keycloak Federated Users - Trigger Password Reset Email in Custom SPI - keycloak

Question

We implemented a keycloak SPI to perform lookups/updates on an external user database.
One of the features we wanted to implement is to trigger an email when users reach a certain number of login attempts. This is something we did in pre-keycloak version of our application and attempting to implement this feature.
The guidance is to use the execute-actions-email admin REST end point by supplying the "UPDATE_PASSWORD" required action along with other inputs. But I consistently get a 403 response.
I was looking around if in the custom SPI there is a way to use the Keycloak Java API instead. I found an implementation of the executeActionsEmail method in UserResource. But this needs some additional initializations (mostly admin privileges I think). I'm stuck here as well.
I'm looking for any working example(s) that would help me understand how to implement this use case. Postman, Java API any thing would be highly appreciated.
Thank you,

Answer 1

This is the final solution:
private boolean triggerExecuteActionsEmailAdminClient(RealmModel realm, UserModel user) {
boolean executed = false;
try {
KeycloakContext context = keycloakSession.getContext();
UriInfo backendUriInfo = context.getUri(UrlType.BACKEND);
String backendBaseUri = backendUriInfo.getBaseUri().toString();
log.info(String.format("backendBaseUri: %s", backendBaseUri));
Keycloak keycloak = KeycloakBuilder.builder().serverUrl(backendBaseUri).realm("master")
.clientId("admin-cli").grantType("password").username("admin").password("******")
.resteasyClient(new ResteasyClientBuilder().connectionPoolSize(10).build()).build();
String realmName = realm.getName();
String userId = user.getId();
keycloak.realm(realmName).users().get(userId).executeActionsEmail(Arrays.asList("UPDATE_PASSWORD"));
executed = true;
} catch (Exception e) {
e.printStackTrace();
}
return executed;
}
standalone.xml in jboss:domain:ee subsystem
<global-modules>
<module name="org.keycloak.keycloak-core"/>
<module name="org.keycloak.keycloak-admin-client"/>
</global-modules>
In lieu of the above, I added the dependencies in the jboss deployment descriptor of the installed custom SPI jar file
<jboss-deployment-structure>
<deployment>
<dependencies>
<module name="org.springframework.security" />
<module name="com.oracledatabase.oracle" />
<module name="org.keycloak.keycloak-core"/>
<module name="org.keycloak.keycloak-server-spi"/>
<module name="org.keycloak.keycloak-server-spi-private"/>
<module name="org.keycloak.keycloak-services"/>
<module name="org.keycloak.keycloak-saml-core-public"/>
<module name="org.keycloak.keycloak-admin-client"/>
<module name="org.jboss.logging"/>
</dependencies>
</deployment>
Installing the keycloak-admin-client module, make sure keycloak-admin-client-14.0.0.jar is available in /tmp
sudo $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add --name=org.keycloak.keycloak-admin-client --resources=/tmp/keycloak-admin-client-14.0.0.jar --dependencies=org.keycloak.keycloak-core,org.keycloak.keycloak-common,org.apache.httpcomponents,javax.ws.rs.api,org.jboss.resteasy.resteasy-jaxrs"