Skip to search

UserFederation

ldap.keycloak.m.crossplane.io / v1alpha1

apiVersion: ldap.keycloak.m.crossplane.io/v1alpha1 kind: UserFederation metadata: name: example
View raw schema
apiVersion string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata object
spec object required
UserFederationSpec defines the desired state of UserFederation
forProvider object required
batchSizeForSync number
The number of users to sync within a single transaction. Defaults to 1000. The number of users to sync within a single transaction.
bindCredentialSecretRef object
Password of LDAP admin. This attribute must be set if bind_dn is set. Password of LDAP admin.
key string required
name string required
Name of the secret.
bindDn string
DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set. DN of LDAP admin, which will be used by Keycloak to access LDAP server.
cache []object
A block containing the cache settings. Settings regarding cache policy for this realm.
evictionDay number
Day of the week the entry will become invalid on Day of the week the entry will become invalid on.
evictionHour number
Hour of day the entry will become invalid on. Hour of day the entry will become invalid on.
evictionMinute number
Minute of day the entry will become invalid on. Minute of day the entry will become invalid on.
maxLifespan string
Max lifespan of cache entry (duration string). Max lifespan of cache entry (duration string).
policy string
Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.
changedSyncPeriod number
How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync. How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.
connectionPooling boolean
When true, LDAP connection pooling is enabled. Defaults to false. When true, Keycloak will use connection pooling when connecting to LDAP.
connectionTimeout string
LDAP connection timeout in the format of a Go duration string. LDAP connection timeout (duration string)
connectionUrl string
Connection URL to the LDAP server. Connection URL to the LDAP server.
customUserSearchFilter string
Additional LDAP filter for filtering searched users. Must begin with ( and end with ). Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
debug string
Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false: true: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule
deleteDefaultMappers boolean
When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false. When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.
editMode string
Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY. READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
enabled boolean
When false, this provider will not be used when performing queries for users. Defaults to true. When false, this provider will not be used when performing queries for users.
fullSyncPeriod number
How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync. How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
importEnabled boolean
When true, LDAP users will be imported into the Keycloak database. Defaults to true. When true, LDAP users will be imported into the Keycloak database.
kerberos []object
A block containing the kerberos settings. Settings regarding kerberos authentication for this realm.
kerberosRealm string
The name of the kerberos realm, e.g. FOO.LOCAL. The name of the kerberos realm, e.g. FOO.LOCAL
keyTab string
Path to the kerberos keytab file on the server with credentials of the service principal. Path to the kerberos keytab file on the server with credentials of the service principal.
serverPrincipal string
The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'. The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.
useKerberosForPasswordAuthentication boolean
Use kerberos login module instead of ldap service api. Defaults to false. Use kerberos login module instead of ldap service api. Defaults to `false`.
krbPrincipalAttribute string
Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'. Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.
name string
Display name of the provider when displayed in the console. Display name of the provider when displayed in the console.
pagination boolean
When true, Keycloak assumes the LDAP server supports pagination. Defaults to true. When true, Keycloak assumes the LDAP server supports pagination.
priority number
Priority of this provider when looking up users. Lower values are first. Defaults to 0. Priority of this provider when looking up users. Lower values are first.
rdnLdapAttribute string
Name of the LDAP attribute to use as the relative distinguished name. Name of the LDAP attribute to use as the relative distinguished name.
readTimeout string
LDAP read timeout in the format of a Go duration string. LDAP read timeout (duration string)
realmId string
The realm that this provider will provide user federation for. The realm this provider will provide user federation for.
realmIdRef object
Reference to a Realm in realm to populate realmId.
name string required
Name of the referenced object.
namespace string
Namespace of the referenced object
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
realmIdSelector object
Selector for a Realm in realm to populate realmId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
namespace string
Namespace for the selector
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
relativeCreateDn string
Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN. Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.
searchScope string
Can be one of ONE_LEVEL or SUBTREE: ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
startTls boolean
When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling. When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.
syncRegistrations boolean
When true, newly created users will be synced back to LDAP. Defaults to false. When true, newly created users will be synced back to LDAP.
trustEmail boolean
If enabled, email provided by this provider is not verified even if verification is enabled for the realm. If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
usePasswordModifyExtendedOp boolean
When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062). When `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).
useTruststoreSpi string
Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:
userObjectClasses []string
Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one. All values of LDAP objectClass attribute for users in LDAP.
usernameLdapAttribute string
Name of the LDAP attribute to use as the Keycloak username. Name of the LDAP attribute to use as the Keycloak username.
usersDn string
Full DN of LDAP tree where your users are. Full DN of LDAP tree where your users are.
uuidLdapAttribute string
Name of the LDAP attribute to use as a unique object identifier for objects in LDAP. Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
validatePasswordPolicy boolean
When true, Keycloak will validate passwords using the realm policy before updating it. When true, Keycloak will validate passwords using the realm policy before updating it.
vendor string
Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER. LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.
initProvider object
THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.
batchSizeForSync number
The number of users to sync within a single transaction. Defaults to 1000. The number of users to sync within a single transaction.
bindCredentialSecretRef object
Password of LDAP admin. This attribute must be set if bind_dn is set. Password of LDAP admin.
key string required
name string required
Name of the secret.
bindDn string
DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set. DN of LDAP admin, which will be used by Keycloak to access LDAP server.
cache []object
A block containing the cache settings. Settings regarding cache policy for this realm.
evictionDay number
Day of the week the entry will become invalid on Day of the week the entry will become invalid on.
evictionHour number
Hour of day the entry will become invalid on. Hour of day the entry will become invalid on.
evictionMinute number
Minute of day the entry will become invalid on. Minute of day the entry will become invalid on.
maxLifespan string
Max lifespan of cache entry (duration string). Max lifespan of cache entry (duration string).
policy string
Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.
changedSyncPeriod number
How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync. How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.
connectionPooling boolean
When true, LDAP connection pooling is enabled. Defaults to false. When true, Keycloak will use connection pooling when connecting to LDAP.
connectionTimeout string
LDAP connection timeout in the format of a Go duration string. LDAP connection timeout (duration string)
connectionUrl string
Connection URL to the LDAP server. Connection URL to the LDAP server.
customUserSearchFilter string
Additional LDAP filter for filtering searched users. Must begin with ( and end with ). Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
debug string
Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false: true: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule
deleteDefaultMappers boolean
When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false. When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.
editMode string
Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY. READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
enabled boolean
When false, this provider will not be used when performing queries for users. Defaults to true. When false, this provider will not be used when performing queries for users.
fullSyncPeriod number
How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync. How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
importEnabled boolean
When true, LDAP users will be imported into the Keycloak database. Defaults to true. When true, LDAP users will be imported into the Keycloak database.
kerberos []object
A block containing the kerberos settings. Settings regarding kerberos authentication for this realm.
kerberosRealm string
The name of the kerberos realm, e.g. FOO.LOCAL. The name of the kerberos realm, e.g. FOO.LOCAL
keyTab string
Path to the kerberos keytab file on the server with credentials of the service principal. Path to the kerberos keytab file on the server with credentials of the service principal.
serverPrincipal string
The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'. The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.
useKerberosForPasswordAuthentication boolean
Use kerberos login module instead of ldap service api. Defaults to false. Use kerberos login module instead of ldap service api. Defaults to `false`.
krbPrincipalAttribute string
Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'. Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.
name string
Display name of the provider when displayed in the console. Display name of the provider when displayed in the console.
pagination boolean
When true, Keycloak assumes the LDAP server supports pagination. Defaults to true. When true, Keycloak assumes the LDAP server supports pagination.
priority number
Priority of this provider when looking up users. Lower values are first. Defaults to 0. Priority of this provider when looking up users. Lower values are first.
rdnLdapAttribute string
Name of the LDAP attribute to use as the relative distinguished name. Name of the LDAP attribute to use as the relative distinguished name.
readTimeout string
LDAP read timeout in the format of a Go duration string. LDAP read timeout (duration string)
realmId string
The realm that this provider will provide user federation for. The realm this provider will provide user federation for.
realmIdRef object
Reference to a Realm in realm to populate realmId.
name string required
Name of the referenced object.
namespace string
Namespace of the referenced object
policy object
Policies for referencing.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
realmIdSelector object
Selector for a Realm in realm to populate realmId.
matchControllerRef boolean
MatchControllerRef ensures an object with the same controller reference as the selecting object is selected.
matchLabels object
MatchLabels ensures an object with matching labels is selected.
namespace string
Namespace for the selector
policy object
Policies for selection.
resolution string
Resolution specifies whether resolution of this reference is required. The default is 'Required', which means the reconcile will fail if the reference cannot be resolved. 'Optional' means this reference will be a no-op if it cannot be resolved.
enum: Required, Optional
resolve string
Resolve specifies when this reference should be resolved. The default is 'IfNotPresent', which will attempt to resolve the reference only when the corresponding field is not present. Use 'Always' to resolve the reference on every reconcile.
enum: Always, IfNotPresent
relativeCreateDn string
Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN. Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.
searchScope string
Can be one of ONE_LEVEL or SUBTREE: ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
startTls boolean
When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling. When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.
syncRegistrations boolean
When true, newly created users will be synced back to LDAP. Defaults to false. When true, newly created users will be synced back to LDAP.
trustEmail boolean
If enabled, email provided by this provider is not verified even if verification is enabled for the realm. If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
usePasswordModifyExtendedOp boolean
When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062). When `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).
useTruststoreSpi string
Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:
userObjectClasses []string
Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one. All values of LDAP objectClass attribute for users in LDAP.
usernameLdapAttribute string
Name of the LDAP attribute to use as the Keycloak username. Name of the LDAP attribute to use as the Keycloak username.
usersDn string
Full DN of LDAP tree where your users are. Full DN of LDAP tree where your users are.
uuidLdapAttribute string
Name of the LDAP attribute to use as a unique object identifier for objects in LDAP. Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
validatePasswordPolicy boolean
When true, Keycloak will validate passwords using the realm policy before updating it. When true, Keycloak will validate passwords using the realm policy before updating it.
vendor string
Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER. LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.
managementPolicies []string
THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
providerConfigRef object
ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.
kind string required
Kind of the referenced object.
name string required
Name of the referenced object.
writeConnectionSecretToRef object
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
name string required
Name of the secret.
status object
UserFederationStatus defines the observed state of UserFederation.
atProvider object
batchSizeForSync number
The number of users to sync within a single transaction. Defaults to 1000. The number of users to sync within a single transaction.
bindDn string
DN of LDAP admin, which will be used by Keycloak to access LDAP server. This attribute must be set if bind_credential is set. DN of LDAP admin, which will be used by Keycloak to access LDAP server.
cache []object
A block containing the cache settings. Settings regarding cache policy for this realm.
evictionDay number
Day of the week the entry will become invalid on Day of the week the entry will become invalid on.
evictionHour number
Hour of day the entry will become invalid on. Hour of day the entry will become invalid on.
evictionMinute number
Minute of day the entry will become invalid on. Minute of day the entry will become invalid on.
maxLifespan string
Max lifespan of cache entry (duration string). Max lifespan of cache entry (duration string).
policy string
Can be one of DEFAULT, EVICT_DAILY, EVICT_WEEKLY, MAX_LIFESPAN, or NO_CACHE. Defaults to DEFAULT.
changedSyncPeriod number
How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync. How frequently Keycloak should sync changed LDAP users, in seconds. Omit this property to disable periodic changed users sync.
connectionPooling boolean
When true, LDAP connection pooling is enabled. Defaults to false. When true, Keycloak will use connection pooling when connecting to LDAP.
connectionTimeout string
LDAP connection timeout in the format of a Go duration string. LDAP connection timeout (duration string)
connectionUrl string
Connection URL to the LDAP server. Connection URL to the LDAP server.
customUserSearchFilter string
Additional LDAP filter for filtering searched users. Must begin with ( and end with ). Additional LDAP filter for filtering searched users. Must begin with '(' and end with ')'.
debug string
Can be one of true or false. Will enable/disable logging for Kerberos Authentication. Defaults to false: true: enables debug logging for Krb5LoginModule. false: disables debug logging for Krb5LoginModule
deleteDefaultMappers boolean
When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider. Defaults to false. When true, the provider will delete the default mappers which are normally created by Keycloak when creating an LDAP user federation provider.
editMode string
Can be one of READ_ONLY, WRITABLE, or UNSYNCED. UNSYNCED allows user data to be imported but not synced back to LDAP. Defaults to READ_ONLY. READ_ONLY and WRITABLE are self-explanatory. UNSYNCED allows user data to be imported but not synced back to LDAP.
enabled boolean
When false, this provider will not be used when performing queries for users. Defaults to true. When false, this provider will not be used when performing queries for users.
fullSyncPeriod number
How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync. How frequently Keycloak should sync all LDAP users, in seconds. Omit this property to disable periodic full sync.
id string
importEnabled boolean
When true, LDAP users will be imported into the Keycloak database. Defaults to true. When true, LDAP users will be imported into the Keycloak database.
kerberos []object
A block containing the kerberos settings. Settings regarding kerberos authentication for this realm.
kerberosRealm string
The name of the kerberos realm, e.g. FOO.LOCAL. The name of the kerberos realm, e.g. FOO.LOCAL
keyTab string
Path to the kerberos keytab file on the server with credentials of the service principal. Path to the kerberos keytab file on the server with credentials of the service principal.
serverPrincipal string
The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'. The kerberos server principal, e.g. 'HTTP/host.foo.com@FOO.LOCAL'.
useKerberosForPasswordAuthentication boolean
Use kerberos login module instead of ldap service api. Defaults to false. Use kerberos login module instead of ldap service api. Defaults to `false`.
krbPrincipalAttribute string
Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'. Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.
name string
Display name of the provider when displayed in the console. Display name of the provider when displayed in the console.
pagination boolean
When true, Keycloak assumes the LDAP server supports pagination. Defaults to true. When true, Keycloak assumes the LDAP server supports pagination.
priority number
Priority of this provider when looking up users. Lower values are first. Defaults to 0. Priority of this provider when looking up users. Lower values are first.
rdnLdapAttribute string
Name of the LDAP attribute to use as the relative distinguished name. Name of the LDAP attribute to use as the relative distinguished name.
readTimeout string
LDAP read timeout in the format of a Go duration string. LDAP read timeout (duration string)
realmId string
The realm that this provider will provide user federation for. The realm this provider will provide user federation for.
relativeCreateDn string
Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN. Relative DN of LDAP tree where new users will be created. Keycloak will use the Users DN as the base for the new user's DN.
searchScope string
Can be one of ONE_LEVEL or SUBTREE: ONE_LEVEL: only search for users in the DN specified by user_dn. SUBTREE: search entire LDAP subtree.
startTls boolean
When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling. When true, Keycloak will encrypt the connection to LDAP using STARTTLS, which will disable connection pooling.
syncRegistrations boolean
When true, newly created users will be synced back to LDAP. Defaults to false. When true, newly created users will be synced back to LDAP.
trustEmail boolean
If enabled, email provided by this provider is not verified even if verification is enabled for the realm. If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
usePasswordModifyExtendedOp boolean
When true, use the LDAPv3 Password Modify Extended Operation (RFC-3062). When `true`, use the LDAPv3 Password Modify Extended Operation (RFC-3062).
useTruststoreSpi string
Can be one of ALWAYS, ONLY_FOR_LDAPS, or NEVER:
userObjectClasses []string
Array of all values of LDAP objectClass attribute for users in LDAP. Must contain at least one. All values of LDAP objectClass attribute for users in LDAP.
usernameLdapAttribute string
Name of the LDAP attribute to use as the Keycloak username. Name of the LDAP attribute to use as the Keycloak username.
usersDn string
Full DN of LDAP tree where your users are. Full DN of LDAP tree where your users are.
uuidLdapAttribute string
Name of the LDAP attribute to use as a unique object identifier for objects in LDAP. Name of the LDAP attribute to use as a unique object identifier for objects in LDAP.
validatePasswordPolicy boolean
When true, Keycloak will validate passwords using the realm policy before updating it. When true, Keycloak will validate passwords using the realm policy before updating it.
vendor string
Can be one of OTHER, EDIRECTORY, AD, RHDS, or TIVOLI. When this is selected in the GUI, it provides reasonable defaults for other fields. When used with the Keycloak API, this attribute does nothing, but is still required. Defaults to OTHER. LDAP vendor. I am almost certain this field does nothing, but the UI indicates that it is required.
conditions []object
Conditions of the resource.
lastTransitionTime string required
LastTransitionTime is the last time this condition transitioned from one status to another.
format: date-time
message string
A Message containing details about this condition's last transition from one status to another, if any.
observedGeneration integer
ObservedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format: int64
reason string required
A Reason for this condition's last transition from one status to another.
status string required
Status of this condition; is it currently True, False, or Unknown?
type string required
Type of this condition. At most one of each condition type may apply to a resource at any point in time.
observedGeneration integer
ObservedGeneration is the latest metadata.generation which resulted in either a ready state, or stalled due to error it can not recover from without human intervention.
format: int64

No matches. Try .spec.forProvider for an exact path