Add protocol-mapper to keycloak using kcadm.sh

Question

I have been trying to setup my full test system in keycloak using the kcadmin cli, but I have some problems creating protocol mappers:

HTTP error - 400 Bad Request

I have been trying to implement a request using:

http://www.keycloak.org/docs-api/3.3/rest-api/index.html http://blog.keycloak.org/2017/01/administer-keycloak-server-from-shell.html

Am I missing something in the request:

/opt/jboss/keycloak/bin/kcadm.sh create \
clients/7e8ef93b-0d0f-487d-84a5-5cfaee7ddf13/protocol-mappers/models \
-r $test_realm \
-s config.user.attribute=tenants \
-s config.claim.name=tenants \
-s config.jsonType.label=String \
-s config.id.token.claim=true \
-s config.access.token.claim=true \
-s config.userinfo.token.claim=true \
-s config.multivalued=true \
-s name=tenants \
-s protocolMapper=oidc-usermodel-attribute-mapper

This works:

/opt/jboss/keycloak/bin/kcadm.sh create \
clients/7e8ef93b-0d0f-487d-84a5-5cfaee7ddf13/protocol-mappers/models \
-r $test_realm \
-s name=tenants1 \
-s protocol=openid-connect \
-s protocolMapper=oidc-usermodel-attribute-mapper

Answer 1

You need to specify nested config values like this in Linux:

-s 'config."id.token.claim"=true'
-s 'config."included.client.audience"=theclient'

Answer 2

In the failing example the following value is missing:
-s protocol=openid-connect