{ "description": "UserFederation is the Schema for the UserFederations API.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "spec": { "additionalProperties": false, "description": "UserFederationSpec defines the desired state of UserFederation", "properties": { "deletionPolicy": { "default": "Delete", "description": "DeletionPolicy specifies what will happen to the underlying external\nwhen this managed resource is deleted - either \"Delete\" or \"Orphan\" the\nexternal resource.\nThis field is planned to be deprecated in favor of the ManagementPolicies\nfield in a future release. Currently, both could be set independently and\nnon-default values would be honored if the feature flag is enabled.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223", "enum": [ "Orphan", "Delete" ], "type": [ "string", "null" ] }, "forProvider": { "additionalProperties": false, "properties": { "batchSizeForSync": { "description": "The number of users to sync within a single transaction. Defaults to 1000.\nThe number of users to sync within a single transaction.", "type": [ "number", "null" ] }, "bindCredentialSecretRef": { "additionalProperties": false, "description": "Password of LDAP admin. This attribute must be set if bind_dn is set.\nPassword of LDAP admin.", "properties": { "key": { "description": "The key to select.", "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "key", "name", "namespace" ], "type": [ "object", "null" ] }, "bindDn": { "description": "DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set.\nDN of LDAP admin, which will be used by Keycloak to access LDAP server.", "type": [ "string", "null" ] }, "cache": { "description": "A block containing the cache settings.\nSettings regarding cache policy for this realm.", "items": { "additionalProperties": false, "properties": { "evictionDay": { "description": "Day of the week the entry will become invalid on\nDay of the week the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionHour": { "description": "Hour of day the entry will become invalid on.\nHour of day the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionMinute": { "description": "Minute of day the entry will become invalid on.\nMinute of day the entry will become invalid on.", "type": [ "number", "null" ] }, "maxLifespan": { "description": "Max lifespan of cache entry (duration string).\nMax lifespan of cache entry (duration string).", "type": [ "string", "null" ] }, "policy": { "description": "Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "changedSyncPeriod": { "description": "How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.\nHow frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.", "type": [ "number", "null" ] }, "connectionPooling": { "description": "When true, LDAP connection pooling is enabled. Defaults to false.\nWhen true, Keycloak will use connection pooling when connecting to LDAP.", "type": [ "boolean", "null" ] }, "connectionTimeout": { "description": "LDAP connection timeout in the format of a Go duration string.\nLDAP connection timeout (duration string)", "type": [ "string", "null" ] }, "connectionUrl": { "description": "Connection URL to the LDAP server.\nConnection URL to the LDAP server.", "type": [ "string", "null" ] }, "customUserSearchFilter": { "description": "Additional LDAP filter for filtering searched users. Must begin with ( and end with ).\nAdditional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.", "type": [ "string", "null" ] }, "debug": { "description": "Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false:\ntrue: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule", "type": [ "string", "null" ] }, "deleteDefaultMappers": { "description": "When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false.\nWhen true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.", "type": [ "boolean", "null" ] }, "editMode": { "description": "Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY.\nREAD_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, this provider will not be used when performing queries for users. Defaults to true.\nWhen false, this provider will not be used when performing queries for users.", "type": [ "boolean", "null" ] }, "fullSyncPeriod": { "description": "How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.\nHow frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.", "type": [ "number", "null" ] }, "importEnabled": { "description": "When true, LDAP users will be imported into the Keycloak database. Defaults to true.\nWhen true, LDAP users will be imported into the Keycloak database.", "type": [ "boolean", "null" ] }, "kerberos": { "description": "A block containing the kerberos settings.\nSettings regarding kerberos authentication for this realm.", "items": { "additionalProperties": false, "properties": { "kerberosRealm": { "description": "The name of the kerberos realm, e.g. FOO.LOCAL.\nThe name of the kerberos realm, e.g. FOO.LOCAL", "type": [ "string", "null" ] }, "keyTab": { "description": "Path to the kerberos keytab file on the server with credentials of the service principal.\nPath to the kerberos keytab file on the server with credentials of the service principal.", "type": [ "string", "null" ] }, "serverPrincipal": { "description": "The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.\nThe kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.", "type": [ "string", "null" ] }, "useKerberosForPasswordAuthentication": { "description": "Use kerberos login module instead of ldap service api. Defaults to false.\nUse kerberos login module instead of ldap service api. Defaults to `false`.", "type": [ "boolean", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "krbPrincipalAttribute": { "description": "Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.\nName of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.", "type": [ "string", "null" ] }, "name": { "description": "Display name of the provider when displayed in the console.\nDisplay name of the provider when displayed in the console.", "type": [ "string", "null" ] }, "pagination": { "description": "When true, Keycloak assumes the LDAP server supports pagination. Defaults to true.\nWhen true, Keycloak assumes the LDAP server supports pagination.", "type": [ "boolean", "null" ] }, "priority": { "description": "Priority of this provider when looking up users. Lower values are first. Defaults to 0.\nPriority of this provider when looking up users. Lower values are first.", "type": [ "number", "null" ] }, "rdnLdapAttribute": { "description": "Name of the LDAP attribute to use as the relative distinguished name.\nName of the LDAP attribute to use as the relative distinguished name.", "type": [ "string", "null" ] }, "readTimeout": { "description": "LDAP read timeout in the format of a Go duration string.\nLDAP read timeout (duration string)", "type": [ "string", "null" ] }, "realmId": { "description": "The realm that this provider will provide user federation for.\nThe realm this provider will provide user federation for.", "type": [ "string", "null" ] }, "realmIdRef": { "additionalProperties": false, "description": "Reference to a Realm in realm to populate realmId.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "additionalProperties": false, "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": [ "string", "null" ] }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "name" ], "type": [ "object", "null" ] }, "realmIdSelector": { "additionalProperties": false, "description": "Selector for a Realm in realm to populate realmId.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": [ "boolean", "null" ] }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": [ "object", "null" ] }, "policy": { "additionalProperties": false, "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": [ "string", "null" ] }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "relativeCreateDn": { "description": "Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.\nRelative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.", "type": [ "string", "null" ] }, "searchScope": { "description": "Can be one of ONE_LEVEL or SUBTREE:\nONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.", "type": [ "string", "null" ] }, "startTls": { "description": "When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.\nWhen true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.", "type": [ "boolean", "null" ] }, "syncRegistrations": { "description": "When true, newly created users will be synced back to LDAP. Defaults to false.\nWhen true, newly created users will be synced back to LDAP.", "type": [ "boolean", "null" ] }, "trustEmail": { "description": "If enabled, email provided by this provider is not verified even if verification is enabled for the realm.\nIf enabled, email provided by this provider is not verified even if verification is enabled for the realm.", "type": [ "boolean", "null" ] }, "usePasswordModifyExtendedOp": { "description": "When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062).\nWhen `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).", "type": [ "boolean", "null" ] }, "useTruststoreSpi": { "description": "Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:", "type": [ "string", "null" ] }, "userObjectClasses": { "description": "Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one.\nAll values of LDAP objectClass attribute for users in LDAP.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "usernameLdapAttribute": { "description": "Name of the LDAP attribute to use as the Keycloak username.\nName of the LDAP attribute to use as the Keycloak username.", "type": [ "string", "null" ] }, "usersDn": { "description": "Full DN of LDAP tree where your users are.\nFull DN of LDAP tree where your users are.", "type": [ "string", "null" ] }, "uuidLdapAttribute": { "description": "Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.\nName of the LDAP attribute to use as a unique object identifier for objects in LDAP.", "type": [ "string", "null" ] }, "validatePasswordPolicy": { "description": "When true, Keycloak will validate passwords using the realm policy before updating it.\nWhen true, Keycloak will validate passwords using the realm policy before updating it.", "type": [ "boolean", "null" ] }, "vendor": { "description": "Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER.\nLDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.", "type": [ "string", "null" ] } }, "type": "object" }, "initProvider": { "additionalProperties": false, "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "batchSizeForSync": { "description": "The number of users to sync within a single transaction. Defaults to 1000.\nThe number of users to sync within a single transaction.", "type": [ "number", "null" ] }, "bindCredentialSecretRef": { "additionalProperties": false, "description": "Password of LDAP admin. This attribute must be set if bind_dn is set.\nPassword of LDAP admin.", "properties": { "key": { "description": "The key to select.", "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "key", "name", "namespace" ], "type": [ "object", "null" ] }, "bindDn": { "description": "DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set.\nDN of LDAP admin, which will be used by Keycloak to access LDAP server.", "type": [ "string", "null" ] }, "cache": { "description": "A block containing the cache settings.\nSettings regarding cache policy for this realm.", "items": { "additionalProperties": false, "properties": { "evictionDay": { "description": "Day of the week the entry will become invalid on\nDay of the week the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionHour": { "description": "Hour of day the entry will become invalid on.\nHour of day the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionMinute": { "description": "Minute of day the entry will become invalid on.\nMinute of day the entry will become invalid on.", "type": [ "number", "null" ] }, "maxLifespan": { "description": "Max lifespan of cache entry (duration string).\nMax lifespan of cache entry (duration string).", "type": [ "string", "null" ] }, "policy": { "description": "Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "changedSyncPeriod": { "description": "How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.\nHow frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.", "type": [ "number", "null" ] }, "connectionPooling": { "description": "When true, LDAP connection pooling is enabled. Defaults to false.\nWhen true, Keycloak will use connection pooling when connecting to LDAP.", "type": [ "boolean", "null" ] }, "connectionTimeout": { "description": "LDAP connection timeout in the format of a Go duration string.\nLDAP connection timeout (duration string)", "type": [ "string", "null" ] }, "connectionUrl": { "description": "Connection URL to the LDAP server.\nConnection URL to the LDAP server.", "type": [ "string", "null" ] }, "customUserSearchFilter": { "description": "Additional LDAP filter for filtering searched users. Must begin with ( and end with ).\nAdditional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.", "type": [ "string", "null" ] }, "debug": { "description": "Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false:\ntrue: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule", "type": [ "string", "null" ] }, "deleteDefaultMappers": { "description": "When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false.\nWhen true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.", "type": [ "boolean", "null" ] }, "editMode": { "description": "Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY.\nREAD_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, this provider will not be used when performing queries for users. Defaults to true.\nWhen false, this provider will not be used when performing queries for users.", "type": [ "boolean", "null" ] }, "fullSyncPeriod": { "description": "How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.\nHow frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.", "type": [ "number", "null" ] }, "importEnabled": { "description": "When true, LDAP users will be imported into the Keycloak database. Defaults to true.\nWhen true, LDAP users will be imported into the Keycloak database.", "type": [ "boolean", "null" ] }, "kerberos": { "description": "A block containing the kerberos settings.\nSettings regarding kerberos authentication for this realm.", "items": { "additionalProperties": false, "properties": { "kerberosRealm": { "description": "The name of the kerberos realm, e.g. FOO.LOCAL.\nThe name of the kerberos realm, e.g. FOO.LOCAL", "type": [ "string", "null" ] }, "keyTab": { "description": "Path to the kerberos keytab file on the server with credentials of the service principal.\nPath to the kerberos keytab file on the server with credentials of the service principal.", "type": [ "string", "null" ] }, "serverPrincipal": { "description": "The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.\nThe kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.", "type": [ "string", "null" ] }, "useKerberosForPasswordAuthentication": { "description": "Use kerberos login module instead of ldap service api. Defaults to false.\nUse kerberos login module instead of ldap service api. Defaults to `false`.", "type": [ "boolean", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "krbPrincipalAttribute": { "description": "Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.\nName of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.", "type": [ "string", "null" ] }, "name": { "description": "Display name of the provider when displayed in the console.\nDisplay name of the provider when displayed in the console.", "type": [ "string", "null" ] }, "pagination": { "description": "When true, Keycloak assumes the LDAP server supports pagination. Defaults to true.\nWhen true, Keycloak assumes the LDAP server supports pagination.", "type": [ "boolean", "null" ] }, "priority": { "description": "Priority of this provider when looking up users. Lower values are first. Defaults to 0.\nPriority of this provider when looking up users. Lower values are first.", "type": [ "number", "null" ] }, "rdnLdapAttribute": { "description": "Name of the LDAP attribute to use as the relative distinguished name.\nName of the LDAP attribute to use as the relative distinguished name.", "type": [ "string", "null" ] }, "readTimeout": { "description": "LDAP read timeout in the format of a Go duration string.\nLDAP read timeout (duration string)", "type": [ "string", "null" ] }, "realmId": { "description": "The realm that this provider will provide user federation for.\nThe realm this provider will provide user federation for.", "type": [ "string", "null" ] }, "realmIdRef": { "additionalProperties": false, "description": "Reference to a Realm in realm to populate realmId.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "additionalProperties": false, "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": [ "string", "null" ] }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "name" ], "type": [ "object", "null" ] }, "realmIdSelector": { "additionalProperties": false, "description": "Selector for a Realm in realm to populate realmId.", "properties": { "matchControllerRef": { "description": "MatchControllerRef ensures an object with the same controller reference\nas the selecting object is selected.", "type": [ "boolean", "null" ] }, "matchLabels": { "additionalProperties": { "type": "string" }, "description": "MatchLabels ensures an object with matching labels is selected.", "type": [ "object", "null" ] }, "policy": { "additionalProperties": false, "description": "Policies for selection.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": [ "string", "null" ] }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": [ "object", "null" ] }, "relativeCreateDn": { "description": "Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.\nRelative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.", "type": [ "string", "null" ] }, "searchScope": { "description": "Can be one of ONE_LEVEL or SUBTREE:\nONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.", "type": [ "string", "null" ] }, "startTls": { "description": "When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.\nWhen true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.", "type": [ "boolean", "null" ] }, "syncRegistrations": { "description": "When true, newly created users will be synced back to LDAP. Defaults to false.\nWhen true, newly created users will be synced back to LDAP.", "type": [ "boolean", "null" ] }, "trustEmail": { "description": "If enabled, email provided by this provider is not verified even if verification is enabled for the realm.\nIf enabled, email provided by this provider is not verified even if verification is enabled for the realm.", "type": [ "boolean", "null" ] }, "usePasswordModifyExtendedOp": { "description": "When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062).\nWhen `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).", "type": [ "boolean", "null" ] }, "useTruststoreSpi": { "description": "Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:", "type": [ "string", "null" ] }, "userObjectClasses": { "description": "Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one.\nAll values of LDAP objectClass attribute for users in LDAP.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "usernameLdapAttribute": { "description": "Name of the LDAP attribute to use as the Keycloak username.\nName of the LDAP attribute to use as the Keycloak username.", "type": [ "string", "null" ] }, "usersDn": { "description": "Full DN of LDAP tree where your users are.\nFull DN of LDAP tree where your users are.", "type": [ "string", "null" ] }, "uuidLdapAttribute": { "description": "Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.\nName of the LDAP attribute to use as a unique object identifier for objects in LDAP.", "type": [ "string", "null" ] }, "validatePasswordPolicy": { "description": "When true, Keycloak will validate passwords using the realm policy before updating it.\nWhen true, Keycloak will validate passwords using the realm policy before updating it.", "type": [ "boolean", "null" ] }, "vendor": { "description": "Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER.\nLDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nThis field is planned to replace the DeletionPolicy field in a future\nrelease. Currently, both could be set independently and non-default\nvalues would be honored if the feature flag is enabled. If both are\ncustom, the DeletionPolicy field will be ignored.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": [ "array", "null" ] }, "providerConfigRef": { "additionalProperties": false, "default": { "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "name": { "description": "Name of the referenced object.", "type": "string" }, "policy": { "additionalProperties": false, "description": "Policies for referencing.", "properties": { "resolution": { "default": "Required", "description": "Resolution specifies whether resolution of this reference is required.\nThe default is 'Required', which means the reconcile will fail if the\nreference cannot be resolved. 'Optional' means this reference will be\na no-op if it cannot be resolved.", "enum": [ "Required", "Optional" ], "type": [ "string", "null" ] }, "resolve": { "description": "Resolve specifies when this reference should be resolved. The default\nis 'IfNotPresent', which will attempt to resolve the reference only when\nthe corresponding field is not present. Use 'Always' to resolve the\nreference on every reconcile.", "enum": [ "Always", "IfNotPresent" ], "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "name" ], "type": [ "object", "null" ] }, "writeConnectionSecretToRef": { "additionalProperties": false, "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "name": { "description": "Name of the secret.", "type": "string" }, "namespace": { "description": "Namespace of the secret.", "type": "string" } }, "required": [ "name", "namespace" ], "type": [ "object", "null" ] } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.connectionUrl is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.connectionUrl) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.connectionUrl))" }, { "message": "spec.forProvider.name is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.name) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.name))" }, { "message": "spec.forProvider.rdnLdapAttribute is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.rdnLdapAttribute) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.rdnLdapAttribute))" }, { "message": "spec.forProvider.userObjectClasses is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.userObjectClasses) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.userObjectClasses))" }, { "message": "spec.forProvider.usernameLdapAttribute is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.usernameLdapAttribute) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.usernameLdapAttribute))" }, { "message": "spec.forProvider.usersDn is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.usersDn) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.usersDn))" }, { "message": "spec.forProvider.uuidLdapAttribute is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.uuidLdapAttribute) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.uuidLdapAttribute))" } ] }, "status": { "additionalProperties": false, "description": "UserFederationStatus defines the observed state of UserFederation.", "properties": { "atProvider": { "additionalProperties": false, "properties": { "batchSizeForSync": { "description": "The number of users to sync within a single transaction. Defaults to 1000.\nThe number of users to sync within a single transaction.", "type": [ "number", "null" ] }, "bindDn": { "description": "DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set.\nDN of LDAP admin, which will be used by Keycloak to access LDAP server.", "type": [ "string", "null" ] }, "cache": { "description": "A block containing the cache settings.\nSettings regarding cache policy for this realm.", "items": { "additionalProperties": false, "properties": { "evictionDay": { "description": "Day of the week the entry will become invalid on\nDay of the week the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionHour": { "description": "Hour of day the entry will become invalid on.\nHour of day the entry will become invalid on.", "type": [ "number", "null" ] }, "evictionMinute": { "description": "Minute of day the entry will become invalid on.\nMinute of day the entry will become invalid on.", "type": [ "number", "null" ] }, "maxLifespan": { "description": "Max lifespan of cache entry (duration string).\nMax lifespan of cache entry (duration string).", "type": [ "string", "null" ] }, "policy": { "description": "Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "changedSyncPeriod": { "description": "How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.\nHow frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.", "type": [ "number", "null" ] }, "connectionPooling": { "description": "When true, LDAP connection pooling is enabled. Defaults to false.\nWhen true, Keycloak will use connection pooling when connecting to LDAP.", "type": [ "boolean", "null" ] }, "connectionTimeout": { "description": "LDAP connection timeout in the format of a Go duration string.\nLDAP connection timeout (duration string)", "type": [ "string", "null" ] }, "connectionUrl": { "description": "Connection URL to the LDAP server.\nConnection URL to the LDAP server.", "type": [ "string", "null" ] }, "customUserSearchFilter": { "description": "Additional LDAP filter for filtering searched users. Must begin with ( and end with ).\nAdditional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.", "type": [ "string", "null" ] }, "debug": { "description": "Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false:\ntrue: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule", "type": [ "string", "null" ] }, "deleteDefaultMappers": { "description": "When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false.\nWhen true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.", "type": [ "boolean", "null" ] }, "editMode": { "description": "Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY.\nREAD_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, this provider will not be used when performing queries for users. Defaults to true.\nWhen false, this provider will not be used when performing queries for users.", "type": [ "boolean", "null" ] }, "fullSyncPeriod": { "description": "How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.\nHow frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.", "type": [ "number", "null" ] }, "id": { "type": [ "string", "null" ] }, "importEnabled": { "description": "When true, LDAP users will be imported into the Keycloak database. Defaults to true.\nWhen true, LDAP users will be imported into the Keycloak database.", "type": [ "boolean", "null" ] }, "kerberos": { "description": "A block containing the kerberos settings.\nSettings regarding kerberos authentication for this realm.", "items": { "additionalProperties": false, "properties": { "kerberosRealm": { "description": "The name of the kerberos realm, e.g. FOO.LOCAL.\nThe name of the kerberos realm, e.g. FOO.LOCAL", "type": [ "string", "null" ] }, "keyTab": { "description": "Path to the kerberos keytab file on the server with credentials of the service principal.\nPath to the kerberos keytab file on the server with credentials of the service principal.", "type": [ "string", "null" ] }, "serverPrincipal": { "description": "The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.\nThe kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.", "type": [ "string", "null" ] }, "useKerberosForPasswordAuthentication": { "description": "Use kerberos login module instead of ldap service api. Defaults to false.\nUse kerberos login module instead of ldap service api. Defaults to `false`.", "type": [ "boolean", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "krbPrincipalAttribute": { "description": "Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.\nName of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.", "type": [ "string", "null" ] }, "name": { "description": "Display name of the provider when displayed in the console.\nDisplay name of the provider when displayed in the console.", "type": [ "string", "null" ] }, "pagination": { "description": "When true, Keycloak assumes the LDAP server supports pagination. Defaults to true.\nWhen true, Keycloak assumes the LDAP server supports pagination.", "type": [ "boolean", "null" ] }, "priority": { "description": "Priority of this provider when looking up users. Lower values are first. Defaults to 0.\nPriority of this provider when looking up users. Lower values are first.", "type": [ "number", "null" ] }, "rdnLdapAttribute": { "description": "Name of the LDAP attribute to use as the relative distinguished name.\nName of the LDAP attribute to use as the relative distinguished name.", "type": [ "string", "null" ] }, "readTimeout": { "description": "LDAP read timeout in the format of a Go duration string.\nLDAP read timeout (duration string)", "type": [ "string", "null" ] }, "realmId": { "description": "The realm that this provider will provide user federation for.\nThe realm this provider will provide user federation for.", "type": [ "string", "null" ] }, "relativeCreateDn": { "description": "Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.\nRelative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.", "type": [ "string", "null" ] }, "searchScope": { "description": "Can be one of ONE_LEVEL or SUBTREE:\nONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.", "type": [ "string", "null" ] }, "startTls": { "description": "When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.\nWhen true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.", "type": [ "boolean", "null" ] }, "syncRegistrations": { "description": "When true, newly created users will be synced back to LDAP. Defaults to false.\nWhen true, newly created users will be synced back to LDAP.", "type": [ "boolean", "null" ] }, "trustEmail": { "description": "If enabled, email provided by this provider is not verified even if verification is enabled for the realm.\nIf enabled, email provided by this provider is not verified even if verification is enabled for the realm.", "type": [ "boolean", "null" ] }, "usePasswordModifyExtendedOp": { "description": "When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062).\nWhen `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).", "type": [ "boolean", "null" ] }, "useTruststoreSpi": { "description": "Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:", "type": [ "string", "null" ] }, "userObjectClasses": { "description": "Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one.\nAll values of LDAP objectClass attribute for users in LDAP.", "items": { "type": "string" }, "type": [ "array", "null" ] }, "usernameLdapAttribute": { "description": "Name of the LDAP attribute to use as the Keycloak username.\nName of the LDAP attribute to use as the Keycloak username.", "type": [ "string", "null" ] }, "usersDn": { "description": "Full DN of LDAP tree where your users are.\nFull DN of LDAP tree where your users are.", "type": [ "string", "null" ] }, "uuidLdapAttribute": { "description": "Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.\nName of the LDAP attribute to use as a unique object identifier for objects in LDAP.", "type": [ "string", "null" ] }, "validatePasswordPolicy": { "description": "When true, Keycloak will validate passwords using the realm policy before updating it.\nWhen true, Keycloak will validate passwords using the realm policy before updating it.", "type": [ "boolean", "null" ] }, "vendor": { "description": "Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER.\nLDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.", "type": [ "string", "null" ] } }, "type": [ "object", "null" ] }, "conditions": { "description": "Conditions of the resource.", "items": { "additionalProperties": false, "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": [ "string", "null" ] }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": [ "integer", "null" ] }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "spec" ], "type": "object" }