diff --git a/keycloak-tf-projekt/modules/clients/main.tf b/keycloak-tf-projekt/modules/clients/main.tf
new file mode 100644
index 0000000..d5875f5
--- /dev/null
+++ b/keycloak-tf-projekt/modules/clients/main.tf
@@ -0,0 +1,49 @@
+resource "keycloak_user" "newUser" {
+  for_each = var.usernames
+
+  realm_id   = var.realm_id
+  username   = each.key
+  email      = each.value.email
+  first_name = each.value.first_name
+  enabled    = true
+
+  initial_password {
+    value     = random_password.initial_password[each.key].result
+    temporary = true
+  }
+
+  required_actions = [
+    "UPDATE_PASSWORD"
+  ]
+}
+
+resource "random_password" "initial_password" {
+  for_each = var.usernames
+
+  length = 16 # 16 Zeichen sind ein guter Standard
+  # special          = true    # Sonderzeichen erlauben
+  # override_special = "!@#%&*" # Welche Sonderzeichen verwendet werden dürfen
+  upper   = true # Großbuchstaben
+  lower   = true # Kleinbuchstaben
+  numeric = true # Zahlen
+}
+
+resource "keycloak_role" "client_role" {
+  realm_id    = var.realm_id
+  client_id   = var.target_client_id
+  name        = "my-client-role"
+  description = "My Client Role"
+}
+
+resource "keycloak_user_roles" "assigned_client_role" {
+  for_each = var.usernames # <-- Iteriert über alle 15 Benutzer
+
+  realm_id  = var.realm_id
+  
+  # Holt die ID der Benutzerinstanz, die der Client-Schlüssel ist
+  user_id   = keycloak_user.newUser[each.key].id 
+  role_ids = [
+    keycloak_role.client_role.id,
+  ]
+
+}
diff --git a/keycloak-tf-projekt/modules/clients/outputs.tf b/keycloak-tf-projekt/modules/clients/outputs.tf
new file mode 100644
index 0000000..48450c3
--- /dev/null
+++ b/keycloak-tf-projekt/modules/clients/outputs.tf
@@ -0,0 +1,8 @@
+# output "all_generated_passwords" {
+#   description = "Map der generierten Passwörter (Username -> Password)."
+
+#   value       = {
+#     for username, password in random_password.initial_password : username => password.result
+#   }
+
+# }
\ No newline at end of file
diff --git a/keycloak-tf-projekt/modules/clients/variables.tf b/keycloak-tf-projekt/modules/clients/variables.tf
new file mode 100644
index 0000000..6e7eef3
--- /dev/null
+++ b/keycloak-tf-projekt/modules/clients/variables.tf
@@ -0,0 +1,23 @@
+variable "realm_id" {
+  description = "Die interne ID des Realms, in dem der Benutzer erstellt werden soll."
+  type        = string
+}
+
+variable "usernames" {
+  description = "Der Benutzername des neuen Keycloak-Benutzers."
+  type = map(object({
+    email = string
+    first_name = string
+  }))
+}
+
+variable "target_client_id" {
+  description = "Die interne ID des Clients, für den Rollen zugewiesen werden sollen."
+  type        = string
+}
+
+variable "role_to_assign" {
+  description = "Der Name der Rolle (z.B. 'user' oder 'admin'), die zugewiesen werden soll."
+  type        = string
+  default     = "user" // Standardrolle 'user'
+}
\ No newline at end of file
diff --git a/keycloak-tf-projekt/modules/clients/versions.tf b/keycloak-tf-projekt/modules/clients/versions.tf
new file mode 100644
index 0000000..4a606f2
--- /dev/null
+++ b/keycloak-tf-projekt/modules/clients/versions.tf
@@ -0,0 +1,8 @@
+terraform {
+  required_providers {
+    // Definiert den Keycloak Provider
+    keycloak = {
+      source  = "keycloak/keycloak"
+    }
+  }
+}
\ No newline at end of file