private Keycloak getClient() {
        String secret = (String) keycloakDeployment.getResourceCredentials().get("secret");

        if (secret == null) {
            throw new IllegalArgumentException("No client secret defined in Keycloak config");
        }

        return Keycloak.getInstance(
             keycloakDeployment.getAuthServerBaseUrl(),
             keycloakDeployment.getRealm(),
             APIMAN_CLIENT, // TODO can I get this from the deployment somehow?
             secret,
             APIMAN_CLIENT
        );
    }
Please be careful when using this not to ask for roles that may have a massive number of users.
<p>
If that is required, then a paginated approach may be necessary.
<p>
Ensure that the APIMAN_CLIENT has 'service accounts enabled' set to true. This allows Apiman to speak to Keycloak
using the client name + secret to interact with the Keycloak API.
<p>
Ignores users who are not enabled.

@param roleName the name of the role.
@return the user IDs of users for a given role.
manager/api/security/src/main/java/io/apiman/manager/api/security/impl/KeycloakAdminClient.java