So I go into keycloak admin and look at the admincloak user in the master realm, select a realm under client roles, and long list of effective roles (no assigned or available roles) but for both SpringBootKeycloak realm and Master realm there is no realm-management. There is however a manage-realm which I guess is the same thing. So admincloak does have those permissions. Which leads back to the base question, why is admincloak getting invalid user credentials error. Should realm be master for the KeycloakBuilder object and then changed for the line keycloak.realm(REALM).users().create(userRepresentation); so that REALM is SpringBootKeycloak. PS - sorry for the awful naming - this was originally just going to be a quick play. ------ Original Message ------ From: "Tony Harris" <Tony.Harris@oneadvanced.com<mailto:Tony.Harris@oneadvanced.com>> To: "John Norris" <johnnorris-10@outlook.com<mailto:johnnorris-10@outlook.com>>; "keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>" <keycloak-user@lists.jboss.org<mailto:keycloak-user@lists.jboss.org>> Sent: 04/12/2019 17:35:01 Subject: RE: create user via java api If you look under the Users Role mapping tab, and select the client Roles for realm-management you will find all the roles there.