Realm
realm.keycloak.crossplane.io / v1alpha1
apiVersion: realm.keycloak.crossplane.io/v1alpha1
kind: Realm
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object required
RealmSpec defines the desired state of Realm
deletionPolicy
string
DeletionPolicy specifies what will happen to the underlying external
when this managed resource is deleted - either "Delete" or "Orphan" the
external resource.
This field is planned to be deprecated in favor of the ManagementPolicies
field in a future release. Currently, both could be set independently and
non-default values would be honored if the feature flag is enabled.
See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
enum:
Orphan, DeleteforProvider object required
accessCodeLifespan
string
The maximum amount of time a client has to finish the authorization code flow.
accessCodeLifespanLogin
string
The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.
accessCodeLifespanUserAction
string
The maximum amount of time a user has to complete login related actions, such as updating a password.
accessTokenLifespan
string
The amount of time an access token can be used before it expires.
accessTokenLifespanForImplicitFlow
string
The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.
accountTheme
string
Used for account management pages.
actionTokenGeneratedByAdminLifespan
string
The maximum time a user has to use an admin-generated permit before it expires.
actionTokenGeneratedByUserLifespan
string
The maximum time a user has to use a user-generated permit before it expires.
adminPermissionsEnabled
boolean
Enables the use of fine grained permissions v2
adminTheme
string
Used for the admin console.
attributes
object
A map of custom attributes to add to the realm.
browserFlow
string
The desired flow for browser authentication. Defaults to browser.
Which flow should be used for BrowserFlow
clientAuthenticationFlow
string
The desired flow for client authentication. Defaults to clients.
Which flow should be used for ClientAuthenticationFlow
clientSessionIdleTimeout
string
The amount of time a session can be idle before it expires. Users can override it for individual clients.
clientSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.
defaultDefaultClientScopes
[]string
A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.
defaultOptionalClientScopes
[]string
A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.
defaultSignatureAlgorithm
string
Default algorithm used to sign tokens for the realm.
directGrantFlow
string
The desired flow for direct access authentication. Defaults to direct grant.
Which flow should be used for DirectGrantFlow
displayName
string
The display name for the realm that is shown when logging in to the admin console.
displayNameHtml
string
The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
dockerAuthenticationFlow
string
The desired flow for Docker authentication. Defaults to docker auth.
Which flow should be used for DockerAuthenticationFlow
duplicateEmailsAllowed
boolean
When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.
editUsernameAllowed
boolean
When true, the username field is editable.
emailTheme
string
Used for emails that are sent by Keycloak.
enabled
boolean
When false, users and clients will not be able to access this realm. Defaults to true.
firstBrokerLoginFlow
string
The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.
Which flow should be used for FirstBrokerLoginFlow
internalId
string
When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
internationalization []object
defaultLocale
string
The locale to use by default. This locale code must be present within the supported_locales list.
supportedLocales
[]string
A list of ISO 639-1 locale codes that the realm should support.
loginTheme
string
Used for the login, forgot password, and registration pages.
loginWithEmailAllowed
boolean
When true, users may log in with their email address.
oauth2DeviceCodeLifespan
string
The maximum amount of time a client has to finish the device code flow before it expires.
oauth2DevicePollingInterval
number
The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.
offlineSessionIdleTimeout
string
The amount of time an offline session can be idle before it expires.
offlineSessionMaxLifespan
string
The maximum amount of time before an offline session expires regardless of activity.
offlineSessionMaxLifespanEnabled
boolean
Enable offline_session_max_lifespan.
organizationsEnabled
boolean
When true, organization support is enabled. Defaults to false.
otpPolicy []object
algorithm
string
What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
What hashing algorithm should be used to generate the OTP.
codeReusable
boolean
Possibility to use the same OTP code again after successful authentication. Defaults to false.
digits
number
How many digits the OTP have. Defaults to 6.
initialCounter
number
What should the initial counter value be. Defaults to 2.
lookAheadWindow
number
How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
period
number
How many seconds should an OTP token be valid. Defaults to 30.
type
string
One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
OTP Type, totp for Time-Based One Time Password or hotp for counter base one time password
passwordPolicy
string
The password policy for users within the realm.
String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
realm
string
The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
refreshTokenMaxReuse
number
Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.
registrationAllowed
boolean
When true, user registration will be enabled, and a link for registration will be displayed on the login page.
registrationEmailAsUsername
boolean
When true, the user's email will be used as their username during registration.
registrationFlow
string
The desired flow for user registration. Defaults to registration.
Which flow should be used for RegistrationFlow
rememberMe
boolean
When true, a "remember me" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.
resetCredentialsFlow
string
The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.
Which flow should be used for ResetCredentialsFlow
resetPasswordAllowed
boolean
When true, a "forgot password" link will be displayed on the login page.
revokeRefreshToken
boolean
If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.
securityDefenses []object
bruteForceDetection []object
bruteForceStrategy
string
failureResetTimeSeconds
number
When will failure count be reset?
maxFailureWaitSeconds
number
maxLoginFailures
number
How many failures before wait is triggered.
maxTemporaryLockouts
number
How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0
minimumQuickLoginWaitSeconds
number
How long to wait after a quick login failure.
permanentLockout
boolean
When true, this will lock the user permanently when the user exceeds the maximum login failures.
quickLoginCheckMilliSeconds
number
Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
waitIncrementSeconds
number
This represents the amount of time a user should be locked out when the login failure threshold has been met.
headers []object
contentSecurityPolicy
string
Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
contentSecurityPolicyReportOnly
string
Used for testing Content Security Policies.
referrerPolicy
string
The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
strictTransportSecurity
string
The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
xContentTypeOptions
string
Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
xFrameOptions
string
Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
xRobotsTag
string
Prevent pages from appearing in search engines.
xXssProtection
string
This header configures the Cross-site scripting (XSS) filter in your browser.
smtpServer []object
allowUtf8
boolean
When true, allows UTF-8 in the local part of the email address. Defaults to false.
auth []object
Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:
passwordSecretRef object
The SMTP server password.
key
string required
The key to select.
name
string required
Name of the secret.
namespace
string required
Namespace of the secret.
username
string
The SMTP server username.
envelopeFrom
string
The email address uses for bounces.
from
string
The email address for the sender.
fromDisplayName
string
The display name of the sender email address.
host
string
The host of the SMTP server.
port
string
The port of the SMTP server (defaults to 25).
replyTo
string
The "reply to" email address.
replyToDisplayName
string
The display name of the "reply to" email address.
ssl
boolean
When true, enables SSL. Defaults to false.
starttls
boolean
When true, enables StartTLS. Defaults to false.
tokenAuth []object
Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:
clientId
string
The auth token client ID.
clientSecretSecretRef object
The auth token client secret.
key
string required
The key to select.
name
string required
Name of the secret.
namespace
string required
Namespace of the secret.
scope
string
The auth token scope.
url
string
The auth token URL.
username
string
The SMTP server username.
sslRequired
string
Can be one of following values: 'none, 'external' or 'all'
SSL Required: Values can be 'none', 'external' or 'all'.
ssoSessionIdleTimeout
string
The amount of time a session can be idle before it expires.
ssoSessionIdleTimeoutRememberMe
string
Similar to sso_session_idle_timeout, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_idle_timeout.
ssoSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity.
ssoSessionMaxLifespanRememberMe
string
Similar to sso_session_max_lifespan, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_max_lifespan.
terraformDeletionProtection
boolean
When set to true, the realm cannot be deleted. Defaults to false.
userManagedAccess
boolean
When true, users are allowed to manage their own resources. Defaults to false.
verifyEmail
boolean
When true, users are required to verify their email address after registration and after email address changes.
webAuthnPasswordlessPolicy []object
Configuration for WebAuthn Passwordless Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
passwordlessPasskeysEnabled
boolean
When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.
Enable passkeys for passwordless WebAuthn authentication
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
webAuthnPolicy []object
Configuration for WebAuthn Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
initProvider object
THIS IS A BETA FIELD. It will be honored
unless the Management Policies feature flag is disabled.
InitProvider holds the same fields as ForProvider, with the exception
of Identifier and other resource reference fields. The fields that are
in InitProvider are merged into ForProvider when the resource is created.
The same fields are also added to the terraform ignore_changes hook, to
avoid updating them after creation. This is useful for fields that are
required on creation, but we do not desire to update them after creation,
for example because of an external controller is managing them, like an
autoscaler.
accessCodeLifespan
string
The maximum amount of time a client has to finish the authorization code flow.
accessCodeLifespanLogin
string
The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.
accessCodeLifespanUserAction
string
The maximum amount of time a user has to complete login related actions, such as updating a password.
accessTokenLifespan
string
The amount of time an access token can be used before it expires.
accessTokenLifespanForImplicitFlow
string
The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.
accountTheme
string
Used for account management pages.
actionTokenGeneratedByAdminLifespan
string
The maximum time a user has to use an admin-generated permit before it expires.
actionTokenGeneratedByUserLifespan
string
The maximum time a user has to use a user-generated permit before it expires.
adminPermissionsEnabled
boolean
Enables the use of fine grained permissions v2
adminTheme
string
Used for the admin console.
attributes
object
A map of custom attributes to add to the realm.
browserFlow
string
The desired flow for browser authentication. Defaults to browser.
Which flow should be used for BrowserFlow
clientAuthenticationFlow
string
The desired flow for client authentication. Defaults to clients.
Which flow should be used for ClientAuthenticationFlow
clientSessionIdleTimeout
string
The amount of time a session can be idle before it expires. Users can override it for individual clients.
clientSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.
defaultDefaultClientScopes
[]string
A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.
defaultOptionalClientScopes
[]string
A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.
defaultSignatureAlgorithm
string
Default algorithm used to sign tokens for the realm.
directGrantFlow
string
The desired flow for direct access authentication. Defaults to direct grant.
Which flow should be used for DirectGrantFlow
displayName
string
The display name for the realm that is shown when logging in to the admin console.
displayNameHtml
string
The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
dockerAuthenticationFlow
string
The desired flow for Docker authentication. Defaults to docker auth.
Which flow should be used for DockerAuthenticationFlow
duplicateEmailsAllowed
boolean
When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.
editUsernameAllowed
boolean
When true, the username field is editable.
emailTheme
string
Used for emails that are sent by Keycloak.
enabled
boolean
When false, users and clients will not be able to access this realm. Defaults to true.
firstBrokerLoginFlow
string
The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.
Which flow should be used for FirstBrokerLoginFlow
internalId
string
When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
internationalization []object
defaultLocale
string
The locale to use by default. This locale code must be present within the supported_locales list.
supportedLocales
[]string
A list of ISO 639-1 locale codes that the realm should support.
loginTheme
string
Used for the login, forgot password, and registration pages.
loginWithEmailAllowed
boolean
When true, users may log in with their email address.
oauth2DeviceCodeLifespan
string
The maximum amount of time a client has to finish the device code flow before it expires.
oauth2DevicePollingInterval
number
The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.
offlineSessionIdleTimeout
string
The amount of time an offline session can be idle before it expires.
offlineSessionMaxLifespan
string
The maximum amount of time before an offline session expires regardless of activity.
offlineSessionMaxLifespanEnabled
boolean
Enable offline_session_max_lifespan.
organizationsEnabled
boolean
When true, organization support is enabled. Defaults to false.
otpPolicy []object
algorithm
string
What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
What hashing algorithm should be used to generate the OTP.
codeReusable
boolean
Possibility to use the same OTP code again after successful authentication. Defaults to false.
digits
number
How many digits the OTP have. Defaults to 6.
initialCounter
number
What should the initial counter value be. Defaults to 2.
lookAheadWindow
number
How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
period
number
How many seconds should an OTP token be valid. Defaults to 30.
type
string
One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
OTP Type, totp for Time-Based One Time Password or hotp for counter base one time password
passwordPolicy
string
The password policy for users within the realm.
String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
realm
string
The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
refreshTokenMaxReuse
number
Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.
registrationAllowed
boolean
When true, user registration will be enabled, and a link for registration will be displayed on the login page.
registrationEmailAsUsername
boolean
When true, the user's email will be used as their username during registration.
registrationFlow
string
The desired flow for user registration. Defaults to registration.
Which flow should be used for RegistrationFlow
rememberMe
boolean
When true, a "remember me" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.
resetCredentialsFlow
string
The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.
Which flow should be used for ResetCredentialsFlow
resetPasswordAllowed
boolean
When true, a "forgot password" link will be displayed on the login page.
revokeRefreshToken
boolean
If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.
securityDefenses []object
bruteForceDetection []object
bruteForceStrategy
string
failureResetTimeSeconds
number
When will failure count be reset?
maxFailureWaitSeconds
number
maxLoginFailures
number
How many failures before wait is triggered.
maxTemporaryLockouts
number
How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0
minimumQuickLoginWaitSeconds
number
How long to wait after a quick login failure.
permanentLockout
boolean
When true, this will lock the user permanently when the user exceeds the maximum login failures.
quickLoginCheckMilliSeconds
number
Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
waitIncrementSeconds
number
This represents the amount of time a user should be locked out when the login failure threshold has been met.
headers []object
contentSecurityPolicy
string
Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
contentSecurityPolicyReportOnly
string
Used for testing Content Security Policies.
referrerPolicy
string
The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
strictTransportSecurity
string
The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
xContentTypeOptions
string
Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
xFrameOptions
string
Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
xRobotsTag
string
Prevent pages from appearing in search engines.
xXssProtection
string
This header configures the Cross-site scripting (XSS) filter in your browser.
smtpServer []object
allowUtf8
boolean
When true, allows UTF-8 in the local part of the email address. Defaults to false.
auth []object
Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:
passwordSecretRef object required
The SMTP server password.
key
string required
The key to select.
name
string required
Name of the secret.
namespace
string required
Namespace of the secret.
username
string
The SMTP server username.
envelopeFrom
string
The email address uses for bounces.
from
string
The email address for the sender.
fromDisplayName
string
The display name of the sender email address.
host
string
The host of the SMTP server.
port
string
The port of the SMTP server (defaults to 25).
replyTo
string
The "reply to" email address.
replyToDisplayName
string
The display name of the "reply to" email address.
ssl
boolean
When true, enables SSL. Defaults to false.
starttls
boolean
When true, enables StartTLS. Defaults to false.
tokenAuth []object
Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:
clientId
string
The auth token client ID.
clientSecretSecretRef object required
The auth token client secret.
key
string required
The key to select.
name
string required
Name of the secret.
namespace
string required
Namespace of the secret.
scope
string
The auth token scope.
url
string
The auth token URL.
username
string
The SMTP server username.
sslRequired
string
Can be one of following values: 'none, 'external' or 'all'
SSL Required: Values can be 'none', 'external' or 'all'.
ssoSessionIdleTimeout
string
The amount of time a session can be idle before it expires.
ssoSessionIdleTimeoutRememberMe
string
Similar to sso_session_idle_timeout, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_idle_timeout.
ssoSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity.
ssoSessionMaxLifespanRememberMe
string
Similar to sso_session_max_lifespan, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_max_lifespan.
terraformDeletionProtection
boolean
When set to true, the realm cannot be deleted. Defaults to false.
userManagedAccess
boolean
When true, users are allowed to manage their own resources. Defaults to false.
verifyEmail
boolean
When true, users are required to verify their email address after registration and after email address changes.
webAuthnPasswordlessPolicy []object
Configuration for WebAuthn Passwordless Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
passwordlessPasskeysEnabled
boolean
When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.
Enable passkeys for passwordless WebAuthn authentication
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
webAuthnPolicy []object
Configuration for WebAuthn Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
managementPolicies
[]string
THIS IS A BETA FIELD. It is on by default but can be opted out
through a Crossplane feature flag.
ManagementPolicies specify the array of actions Crossplane is allowed to
take on the managed and external resources.
This field is planned to replace the DeletionPolicy field in a future
release. Currently, both could be set independently and non-default
values would be honored if the feature flag is enabled. If both are
custom, the DeletionPolicy field will be ignored.
See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223
and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md
providerConfigRef object
ProviderConfigReference specifies how the provider that will be used to
create, observe, update, and delete this managed resource should be
configured.
name
string required
Name of the referenced object.
policy object
Policies for referencing.
resolution
string
Resolution specifies whether resolution of this reference is required.
The default is 'Required', which means the reconcile will fail if the
reference cannot be resolved. 'Optional' means this reference will be
a no-op if it cannot be resolved.
enum:
Required, Optional
resolve
string
Resolve specifies when this reference should be resolved. The default
is 'IfNotPresent', which will attempt to resolve the reference only when
the corresponding field is not present. Use 'Always' to resolve the
reference on every reconcile.
enum:
Always, IfNotPresentwriteConnectionSecretToRef object
WriteConnectionSecretToReference specifies the namespace and name of a
Secret to which any connection details for this managed resource should
be written. Connection details frequently include the endpoint, username,
and password required to connect to the managed resource.
name
string required
Name of the secret.
namespace
string required
Namespace of the secret.
status object
RealmStatus defines the observed state of Realm.
atProvider object
accessCodeLifespan
string
The maximum amount of time a client has to finish the authorization code flow.
accessCodeLifespanLogin
string
The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.
accessCodeLifespanUserAction
string
The maximum amount of time a user has to complete login related actions, such as updating a password.
accessTokenLifespan
string
The amount of time an access token can be used before it expires.
accessTokenLifespanForImplicitFlow
string
The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.
accountTheme
string
Used for account management pages.
actionTokenGeneratedByAdminLifespan
string
The maximum time a user has to use an admin-generated permit before it expires.
actionTokenGeneratedByUserLifespan
string
The maximum time a user has to use a user-generated permit before it expires.
adminPermissionsEnabled
boolean
Enables the use of fine grained permissions v2
adminTheme
string
Used for the admin console.
attributes
object
A map of custom attributes to add to the realm.
browserFlow
string
The desired flow for browser authentication. Defaults to browser.
Which flow should be used for BrowserFlow
clientAuthenticationFlow
string
The desired flow for client authentication. Defaults to clients.
Which flow should be used for ClientAuthenticationFlow
clientSessionIdleTimeout
string
The amount of time a session can be idle before it expires. Users can override it for individual clients.
clientSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.
defaultDefaultClientScopes
[]string
A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.
defaultOptionalClientScopes
[]string
A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.
defaultSignatureAlgorithm
string
Default algorithm used to sign tokens for the realm.
directGrantFlow
string
The desired flow for direct access authentication. Defaults to direct grant.
Which flow should be used for DirectGrantFlow
displayName
string
The display name for the realm that is shown when logging in to the admin console.
displayNameHtml
string
The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
dockerAuthenticationFlow
string
The desired flow for Docker authentication. Defaults to docker auth.
Which flow should be used for DockerAuthenticationFlow
duplicateEmailsAllowed
boolean
When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.
editUsernameAllowed
boolean
When true, the username field is editable.
emailTheme
string
Used for emails that are sent by Keycloak.
enabled
boolean
When false, users and clients will not be able to access this realm. Defaults to true.
firstBrokerLoginFlow
string
The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.
Which flow should be used for FirstBrokerLoginFlow
id
string
internalId
string
When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
internationalization []object
defaultLocale
string
The locale to use by default. This locale code must be present within the supported_locales list.
supportedLocales
[]string
A list of ISO 639-1 locale codes that the realm should support.
loginTheme
string
Used for the login, forgot password, and registration pages.
loginWithEmailAllowed
boolean
When true, users may log in with their email address.
oauth2DeviceCodeLifespan
string
The maximum amount of time a client has to finish the device code flow before it expires.
oauth2DevicePollingInterval
number
The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.
offlineSessionIdleTimeout
string
The amount of time an offline session can be idle before it expires.
offlineSessionMaxLifespan
string
The maximum amount of time before an offline session expires regardless of activity.
offlineSessionMaxLifespanEnabled
boolean
Enable offline_session_max_lifespan.
organizationsEnabled
boolean
When true, organization support is enabled. Defaults to false.
otpPolicy []object
algorithm
string
What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
What hashing algorithm should be used to generate the OTP.
codeReusable
boolean
Possibility to use the same OTP code again after successful authentication. Defaults to false.
digits
number
How many digits the OTP have. Defaults to 6.
initialCounter
number
What should the initial counter value be. Defaults to 2.
lookAheadWindow
number
How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
period
number
How many seconds should an OTP token be valid. Defaults to 30.
type
string
One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
OTP Type, totp for Time-Based One Time Password or hotp for counter base one time password
passwordPolicy
string
The password policy for users within the realm.
String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
realm
string
The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
refreshTokenMaxReuse
number
Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.
registrationAllowed
boolean
When true, user registration will be enabled, and a link for registration will be displayed on the login page.
registrationEmailAsUsername
boolean
When true, the user's email will be used as their username during registration.
registrationFlow
string
The desired flow for user registration. Defaults to registration.
Which flow should be used for RegistrationFlow
rememberMe
boolean
When true, a "remember me" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.
resetCredentialsFlow
string
The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.
Which flow should be used for ResetCredentialsFlow
resetPasswordAllowed
boolean
When true, a "forgot password" link will be displayed on the login page.
revokeRefreshToken
boolean
If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.
securityDefenses []object
bruteForceDetection []object
bruteForceStrategy
string
failureResetTimeSeconds
number
When will failure count be reset?
maxFailureWaitSeconds
number
maxLoginFailures
number
How many failures before wait is triggered.
maxTemporaryLockouts
number
How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0
minimumQuickLoginWaitSeconds
number
How long to wait after a quick login failure.
permanentLockout
boolean
When true, this will lock the user permanently when the user exceeds the maximum login failures.
quickLoginCheckMilliSeconds
number
Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
waitIncrementSeconds
number
This represents the amount of time a user should be locked out when the login failure threshold has been met.
headers []object
contentSecurityPolicy
string
Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
contentSecurityPolicyReportOnly
string
Used for testing Content Security Policies.
referrerPolicy
string
The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
strictTransportSecurity
string
The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
xContentTypeOptions
string
Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
xFrameOptions
string
Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
xRobotsTag
string
Prevent pages from appearing in search engines.
xXssProtection
string
This header configures the Cross-site scripting (XSS) filter in your browser.
smtpServer []object
allowUtf8
boolean
When true, allows UTF-8 in the local part of the email address. Defaults to false.
auth []object
Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:
username
string
The SMTP server username.
envelopeFrom
string
The email address uses for bounces.
from
string
The email address for the sender.
fromDisplayName
string
The display name of the sender email address.
host
string
The host of the SMTP server.
port
string
The port of the SMTP server (defaults to 25).
replyTo
string
The "reply to" email address.
replyToDisplayName
string
The display name of the "reply to" email address.
ssl
boolean
When true, enables SSL. Defaults to false.
starttls
boolean
When true, enables StartTLS. Defaults to false.
tokenAuth []object
Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:
clientId
string
The auth token client ID.
scope
string
The auth token scope.
url
string
The auth token URL.
username
string
The SMTP server username.
sslRequired
string
Can be one of following values: 'none, 'external' or 'all'
SSL Required: Values can be 'none', 'external' or 'all'.
ssoSessionIdleTimeout
string
The amount of time a session can be idle before it expires.
ssoSessionIdleTimeoutRememberMe
string
Similar to sso_session_idle_timeout, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_idle_timeout.
ssoSessionMaxLifespan
string
The maximum amount of time before a session expires regardless of activity.
ssoSessionMaxLifespanRememberMe
string
Similar to sso_session_max_lifespan, but used when a user clicks "Remember Me". If not set, Keycloak will default to the value of sso_session_max_lifespan.
terraformDeletionProtection
boolean
When set to true, the realm cannot be deleted. Defaults to false.
userManagedAccess
boolean
When true, users are allowed to manage their own resources. Defaults to false.
verifyEmail
boolean
When true, users are required to verify their email address after registration and after email address changes.
webAuthnPasswordlessPolicy []object
Configuration for WebAuthn Passwordless Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
passwordlessPasskeysEnabled
boolean
When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.
Enable passkeys for passwordless WebAuthn authentication
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
webAuthnPolicy []object
Configuration for WebAuthn Policy authentication.
acceptableAaguids
[]string
A set of AAGUIDs for which an authenticator can be registered.
attestationConveyancePreference
string
The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.
Either none, indirect or direct
authenticatorAttachment
string
The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.
Either platform or cross-platform
avoidSameAuthenticatorRegister
boolean
When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
createTimeout
number
The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
discoverableCredential
string
The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
Either required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.
extraOrigins
[]string
A set of extra origins for non-web applications.
relyingPartyEntityName
string
A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
relyingPartyId
string
The WebAuthn relying party ID.
requireResidentKey
string
Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.
Either Yes or No
signatureAlgorithms
[]string
A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.
Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
userVerificationRequirement
string
Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.
Either required, preferred or discouraged
conditions []object
Conditions of the resource.
lastTransitionTime
string required
LastTransitionTime is the last time this condition transitioned from one
status to another.
format:
date-time
message
string
A Message containing details about this condition's last transition from
one status to another, if any.
observedGeneration
integer
ObservedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64
reason
string required
A Reason for this condition's last transition from one status to another.
status
string required
Status of this condition; is it currently True, False, or Unknown?
type
string required
Type of this condition. At most one of each condition type may apply to
a resource at any point in time.
observedGeneration
integer
ObservedGeneration is the latest metadata.generation
which resulted in either a ready state, or stalled due to error
it can not recover from without human intervention.
format:
int64No matches. Try .spec.deletionPolicy for an exact path