{ "description": "Realm is the Schema for the Realms API.", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": [ "string", "null" ] }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": [ "string", "null" ] }, "metadata": { "type": [ "object", "null" ] }, "spec": { "additionalProperties": false, "description": "RealmSpec defines the desired state of Realm", "properties": { "forProvider": { "additionalProperties": false, "properties": { "accessCodeLifespan": { "description": "The maximum amount of time a client has to finish the authorization code flow.", "type": [ "string", "null" ] }, "accessCodeLifespanLogin": { "description": "The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.", "type": [ "string", "null" ] }, "accessCodeLifespanUserAction": { "description": "The maximum amount of time a user has to complete login related actions, such as updating a password.", "type": [ "string", "null" ] }, "accessTokenLifespan": { "description": "The amount of time an access token can be used before it expires.", "type": [ "string", "null" ] }, "accessTokenLifespanForImplicitFlow": { "description": "The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.", "type": [ "string", "null" ] }, "accountTheme": { "description": "Used for account management pages.", "type": [ "string", "null" ] }, "actionTokenGeneratedByAdminLifespan": { "description": "The maximum time a user has to use an admin-generated permit before it expires.", "type": [ "string", "null" ] }, "actionTokenGeneratedByUserLifespan": { "description": "The maximum time a user has to use a user-generated permit before it expires.", "type": [ "string", "null" ] }, "adminPermissionsEnabled": { "description": "Enables the use of fine grained permissions v2", "type": [ "boolean", "null" ] }, "adminTheme": { "description": "Used for the admin console.", "type": [ "string", "null" ] }, "attributes": { "additionalProperties": { "type": "string" }, "description": "A map of custom attributes to add to the realm.", "type": [ "object", "null" ], "x-kubernetes-map-type": "granular" }, "browserFlow": { "description": "The desired flow for browser authentication. Defaults to browser.\nWhich flow should be used for BrowserFlow", "type": [ "string", "null" ] }, "clientAuthenticationFlow": { "description": "The desired flow for client authentication. Defaults to clients.\nWhich flow should be used for ClientAuthenticationFlow", "type": [ "string", "null" ] }, "clientSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires. Users can override it for individual clients.", "type": [ "string", "null" ] }, "clientSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.", "type": [ "string", "null" ] }, "defaultDefaultClientScopes": { "description": "A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultOptionalClientScopes": { "description": "A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultSignatureAlgorithm": { "description": "Default algorithm used to sign tokens for the realm.", "type": [ "string", "null" ] }, "directGrantFlow": { "description": "The desired flow for direct access authentication. Defaults to direct grant.\nWhich flow should be used for DirectGrantFlow", "type": [ "string", "null" ] }, "displayName": { "description": "The display name for the realm that is shown when logging in to the admin console.", "type": [ "string", "null" ] }, "displayNameHtml": { "description": "The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.", "type": [ "string", "null" ] }, "dockerAuthenticationFlow": { "description": "The desired flow for Docker authentication. Defaults to docker auth.\nWhich flow should be used for DockerAuthenticationFlow", "type": [ "string", "null" ] }, "duplicateEmailsAllowed": { "description": "When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.", "type": [ "boolean", "null" ] }, "editUsernameAllowed": { "description": "When true, the username field is editable.", "type": [ "boolean", "null" ] }, "emailTheme": { "description": "Used for emails that are sent by Keycloak.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, users and clients will not be able to access this realm. Defaults to true.", "type": [ "boolean", "null" ] }, "firstBrokerLoginFlow": { "description": "The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.\nWhich flow should be used for FirstBrokerLoginFlow", "type": [ "string", "null" ] }, "internalId": { "description": "When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.", "type": [ "string", "null" ] }, "internationalization": { "items": { "additionalProperties": false, "properties": { "defaultLocale": { "description": "The locale to use by default. This locale code must be present within the supported_locales list.", "type": [ "string", "null" ] }, "supportedLocales": { "description": "A list of ISO 639-1 locale codes that the realm should support.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": [ "array", "null" ] }, "loginTheme": { "description": "Used for the login, forgot password, and registration pages.", "type": [ "string", "null" ] }, "loginWithEmailAllowed": { "description": "When true, users may log in with their email address.", "type": [ "boolean", "null" ] }, "oauth2DeviceCodeLifespan": { "description": "The maximum amount of time a client has to finish the device code flow before it expires.", "type": [ "string", "null" ] }, "oauth2DevicePollingInterval": { "description": "The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.", "type": [ "number", "null" ] }, "offlineSessionIdleTimeout": { "description": "The amount of time an offline session can be idle before it expires.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespan": { "description": "The maximum amount of time before an offline session expires regardless of activity.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespanEnabled": { "description": "Enable offline_session_max_lifespan.", "type": [ "boolean", "null" ] }, "organizationsEnabled": { "description": "When true, organization support is enabled. Defaults to false.", "type": [ "boolean", "null" ] }, "otpPolicy": { "items": { "additionalProperties": false, "properties": { "algorithm": { "description": "What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.\nWhat hashing algorithm should be used to generate the OTP.", "type": [ "string", "null" ] }, "codeReusable": { "description": "Possibility to use the same OTP code again after successful authentication. Defaults to false.", "type": [ "boolean", "null" ] }, "digits": { "description": "How many digits the OTP have. Defaults to 6.", "type": [ "number", "null" ] }, "initialCounter": { "description": "What should the initial counter value be. Defaults to 2.", "type": [ "number", "null" ] }, "lookAheadWindow": { "description": "How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.", "type": [ "number", "null" ] }, "period": { "description": "How many seconds should an OTP token be valid. Defaults to 30.", "type": [ "number", "null" ] }, "type": { "description": "One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.\nOTP Type, totp for Time-Based One Time Password or hotp for counter base one time password", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "passwordPolicy": { "description": "The password policy for users within the realm.\nString that represents the passwordPolicies that are in place. Each policy is separated with \" and \". Supported policies can be found in the server-info providers page. example: \"upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)\"", "type": [ "string", "null" ] }, "realm": { "description": "The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.", "type": [ "string", "null" ] }, "refreshTokenMaxReuse": { "description": "Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.", "type": [ "number", "null" ] }, "registrationAllowed": { "description": "When true, user registration will be enabled, and a link for registration will be displayed on the login page.", "type": [ "boolean", "null" ] }, "registrationEmailAsUsername": { "description": "When true, the user's email will be used as their username during registration.", "type": [ "boolean", "null" ] }, "registrationFlow": { "description": "The desired flow for user registration. Defaults to registration.\nWhich flow should be used for RegistrationFlow", "type": [ "string", "null" ] }, "rememberMe": { "description": "When true, a \"remember me\" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.", "type": [ "boolean", "null" ] }, "resetCredentialsFlow": { "description": "The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.\nWhich flow should be used for ResetCredentialsFlow", "type": [ "string", "null" ] }, "resetPasswordAllowed": { "description": "When true, a \"forgot password\" link will be displayed on the login page.", "type": [ "boolean", "null" ] }, "revokeRefreshToken": { "description": "If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.", "type": [ "boolean", "null" ] }, "securityDefenses": { "items": { "additionalProperties": false, "properties": { "bruteForceDetection": { "items": { "additionalProperties": false, "properties": { "bruteForceStrategy": { "type": [ "string", "null" ] }, "failureResetTimeSeconds": { "description": "When will failure count be reset?", "type": [ "number", "null" ] }, "maxFailureWaitSeconds": { "type": [ "number", "null" ] }, "maxLoginFailures": { "description": "How many failures before wait is triggered.", "type": [ "number", "null" ] }, "maxTemporaryLockouts": { "description": "How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0", "type": [ "number", "null" ] }, "minimumQuickLoginWaitSeconds": { "description": "How long to wait after a quick login failure.", "type": [ "number", "null" ] }, "permanentLockout": { "description": "When true, this will lock the user permanently when the user exceeds the maximum login failures.", "type": [ "boolean", "null" ] }, "quickLoginCheckMilliSeconds": { "description": "Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.", "type": [ "number", "null" ] }, "waitIncrementSeconds": { "description": "This represents the amount of time a user should be locked out when the login failure threshold has been met.", "type": [ "number", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "headers": { "items": { "additionalProperties": false, "properties": { "contentSecurityPolicy": { "description": "Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.", "type": [ "string", "null" ] }, "contentSecurityPolicyReportOnly": { "description": "Used for testing Content Security Policies.", "type": [ "string", "null" ] }, "referrerPolicy": { "description": "The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.", "type": [ "string", "null" ] }, "strictTransportSecurity": { "description": "The Script-Transport-Security HTTP header tells browsers to always use HTTPS.", "type": [ "string", "null" ] }, "xContentTypeOptions": { "description": "Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type", "type": [ "string", "null" ] }, "xFrameOptions": { "description": "Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034", "type": [ "string", "null" ] }, "xRobotsTag": { "description": "Prevent pages from appearing in search engines.", "type": [ "string", "null" ] }, "xXssProtection": { "description": "This header configures the Cross-site scripting (XSS) filter in your browser.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "smtpServer": { "items": { "additionalProperties": false, "properties": { "allowUtf8": { "description": "When true, allows UTF-8 in the local part of the email address. Defaults to false.", "type": [ "boolean", "null" ] }, "auth": { "description": "Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "passwordSecretRef": { "additionalProperties": false, "description": "The SMTP server password.", "properties": { "key": { "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" } }, "required": [ "key", "name" ], "type": [ "object", "null" ] }, "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "envelopeFrom": { "description": "The email address uses for bounces.", "type": [ "string", "null" ] }, "from": { "description": "The email address for the sender.", "type": [ "string", "null" ] }, "fromDisplayName": { "description": "The display name of the sender email address.", "type": [ "string", "null" ] }, "host": { "description": "The host of the SMTP server.", "type": [ "string", "null" ] }, "port": { "description": "The port of the SMTP server (defaults to 25).", "type": [ "string", "null" ] }, "replyTo": { "description": "The \"reply to\" email address.", "type": [ "string", "null" ] }, "replyToDisplayName": { "description": "The display name of the \"reply to\" email address.", "type": [ "string", "null" ] }, "ssl": { "description": "When true, enables SSL. Defaults to false.", "type": [ "boolean", "null" ] }, "starttls": { "description": "When true, enables StartTLS. Defaults to false.", "type": [ "boolean", "null" ] }, "tokenAuth": { "description": "Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "clientId": { "description": "The auth token client ID.", "type": [ "string", "null" ] }, "clientSecretSecretRef": { "additionalProperties": false, "description": "The auth token client secret.", "properties": { "key": { "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" } }, "required": [ "key", "name" ], "type": [ "object", "null" ] }, "scope": { "description": "The auth token scope.", "type": [ "string", "null" ] }, "url": { "description": "The auth token URL.", "type": [ "string", "null" ] }, "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "sslRequired": { "description": "Can be one of following values: 'none, 'external' or 'all'\nSSL Required: Values can be 'none', 'external' or 'all'.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeoutRememberMe": { "description": "Similar to sso_session_idle_timeout, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_idle_timeout.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespanRememberMe": { "description": "Similar to sso_session_max_lifespan, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_max_lifespan.", "type": [ "string", "null" ] }, "terraformDeletionProtection": { "description": "When set to true, the realm cannot be deleted. Defaults to false.", "type": [ "boolean", "null" ] }, "userManagedAccess": { "description": "When true, users are allowed to manage their own resources. Defaults to false.", "type": [ "boolean", "null" ] }, "verifyEmail": { "description": "When true, users are required to verify their email address after registration and after email address changes.", "type": [ "boolean", "null" ] }, "webAuthnPasswordlessPolicy": { "description": "Configuration for WebAuthn Passwordless Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "passwordlessPasskeysEnabled": { "description": "When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.\nEnable passkeys for passwordless WebAuthn authentication", "type": [ "boolean", "null" ] }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "webAuthnPolicy": { "description": "Configuration for WebAuthn Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "initProvider": { "additionalProperties": false, "description": "THIS IS A BETA FIELD. It will be honored\nunless the Management Policies feature flag is disabled.\nInitProvider holds the same fields as ForProvider, with the exception\nof Identifier and other resource reference fields. The fields that are\nin InitProvider are merged into ForProvider when the resource is created.\nThe same fields are also added to the terraform ignore_changes hook, to\navoid updating them after creation. This is useful for fields that are\nrequired on creation, but we do not desire to update them after creation,\nfor example because of an external controller is managing them, like an\nautoscaler.", "properties": { "accessCodeLifespan": { "description": "The maximum amount of time a client has to finish the authorization code flow.", "type": [ "string", "null" ] }, "accessCodeLifespanLogin": { "description": "The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.", "type": [ "string", "null" ] }, "accessCodeLifespanUserAction": { "description": "The maximum amount of time a user has to complete login related actions, such as updating a password.", "type": [ "string", "null" ] }, "accessTokenLifespan": { "description": "The amount of time an access token can be used before it expires.", "type": [ "string", "null" ] }, "accessTokenLifespanForImplicitFlow": { "description": "The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.", "type": [ "string", "null" ] }, "accountTheme": { "description": "Used for account management pages.", "type": [ "string", "null" ] }, "actionTokenGeneratedByAdminLifespan": { "description": "The maximum time a user has to use an admin-generated permit before it expires.", "type": [ "string", "null" ] }, "actionTokenGeneratedByUserLifespan": { "description": "The maximum time a user has to use a user-generated permit before it expires.", "type": [ "string", "null" ] }, "adminPermissionsEnabled": { "description": "Enables the use of fine grained permissions v2", "type": [ "boolean", "null" ] }, "adminTheme": { "description": "Used for the admin console.", "type": [ "string", "null" ] }, "attributes": { "additionalProperties": { "type": "string" }, "description": "A map of custom attributes to add to the realm.", "type": [ "object", "null" ], "x-kubernetes-map-type": "granular" }, "browserFlow": { "description": "The desired flow for browser authentication. Defaults to browser.\nWhich flow should be used for BrowserFlow", "type": [ "string", "null" ] }, "clientAuthenticationFlow": { "description": "The desired flow for client authentication. Defaults to clients.\nWhich flow should be used for ClientAuthenticationFlow", "type": [ "string", "null" ] }, "clientSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires. Users can override it for individual clients.", "type": [ "string", "null" ] }, "clientSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.", "type": [ "string", "null" ] }, "defaultDefaultClientScopes": { "description": "A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultOptionalClientScopes": { "description": "A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultSignatureAlgorithm": { "description": "Default algorithm used to sign tokens for the realm.", "type": [ "string", "null" ] }, "directGrantFlow": { "description": "The desired flow for direct access authentication. Defaults to direct grant.\nWhich flow should be used for DirectGrantFlow", "type": [ "string", "null" ] }, "displayName": { "description": "The display name for the realm that is shown when logging in to the admin console.", "type": [ "string", "null" ] }, "displayNameHtml": { "description": "The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.", "type": [ "string", "null" ] }, "dockerAuthenticationFlow": { "description": "The desired flow for Docker authentication. Defaults to docker auth.\nWhich flow should be used for DockerAuthenticationFlow", "type": [ "string", "null" ] }, "duplicateEmailsAllowed": { "description": "When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.", "type": [ "boolean", "null" ] }, "editUsernameAllowed": { "description": "When true, the username field is editable.", "type": [ "boolean", "null" ] }, "emailTheme": { "description": "Used for emails that are sent by Keycloak.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, users and clients will not be able to access this realm. Defaults to true.", "type": [ "boolean", "null" ] }, "firstBrokerLoginFlow": { "description": "The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.\nWhich flow should be used for FirstBrokerLoginFlow", "type": [ "string", "null" ] }, "internalId": { "description": "When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.", "type": [ "string", "null" ] }, "internationalization": { "items": { "additionalProperties": false, "properties": { "defaultLocale": { "description": "The locale to use by default. This locale code must be present within the supported_locales list.", "type": [ "string", "null" ] }, "supportedLocales": { "description": "A list of ISO 639-1 locale codes that the realm should support.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": [ "array", "null" ] }, "loginTheme": { "description": "Used for the login, forgot password, and registration pages.", "type": [ "string", "null" ] }, "loginWithEmailAllowed": { "description": "When true, users may log in with their email address.", "type": [ "boolean", "null" ] }, "oauth2DeviceCodeLifespan": { "description": "The maximum amount of time a client has to finish the device code flow before it expires.", "type": [ "string", "null" ] }, "oauth2DevicePollingInterval": { "description": "The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.", "type": [ "number", "null" ] }, "offlineSessionIdleTimeout": { "description": "The amount of time an offline session can be idle before it expires.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespan": { "description": "The maximum amount of time before an offline session expires regardless of activity.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespanEnabled": { "description": "Enable offline_session_max_lifespan.", "type": [ "boolean", "null" ] }, "organizationsEnabled": { "description": "When true, organization support is enabled. Defaults to false.", "type": [ "boolean", "null" ] }, "otpPolicy": { "items": { "additionalProperties": false, "properties": { "algorithm": { "description": "What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.\nWhat hashing algorithm should be used to generate the OTP.", "type": [ "string", "null" ] }, "codeReusable": { "description": "Possibility to use the same OTP code again after successful authentication. Defaults to false.", "type": [ "boolean", "null" ] }, "digits": { "description": "How many digits the OTP have. Defaults to 6.", "type": [ "number", "null" ] }, "initialCounter": { "description": "What should the initial counter value be. Defaults to 2.", "type": [ "number", "null" ] }, "lookAheadWindow": { "description": "How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.", "type": [ "number", "null" ] }, "period": { "description": "How many seconds should an OTP token be valid. Defaults to 30.", "type": [ "number", "null" ] }, "type": { "description": "One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.\nOTP Type, totp for Time-Based One Time Password or hotp for counter base one time password", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "passwordPolicy": { "description": "The password policy for users within the realm.\nString that represents the passwordPolicies that are in place. Each policy is separated with \" and \". Supported policies can be found in the server-info providers page. example: \"upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)\"", "type": [ "string", "null" ] }, "realm": { "description": "The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.", "type": [ "string", "null" ] }, "refreshTokenMaxReuse": { "description": "Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.", "type": [ "number", "null" ] }, "registrationAllowed": { "description": "When true, user registration will be enabled, and a link for registration will be displayed on the login page.", "type": [ "boolean", "null" ] }, "registrationEmailAsUsername": { "description": "When true, the user's email will be used as their username during registration.", "type": [ "boolean", "null" ] }, "registrationFlow": { "description": "The desired flow for user registration. Defaults to registration.\nWhich flow should be used for RegistrationFlow", "type": [ "string", "null" ] }, "rememberMe": { "description": "When true, a \"remember me\" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.", "type": [ "boolean", "null" ] }, "resetCredentialsFlow": { "description": "The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.\nWhich flow should be used for ResetCredentialsFlow", "type": [ "string", "null" ] }, "resetPasswordAllowed": { "description": "When true, a \"forgot password\" link will be displayed on the login page.", "type": [ "boolean", "null" ] }, "revokeRefreshToken": { "description": "If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.", "type": [ "boolean", "null" ] }, "securityDefenses": { "items": { "additionalProperties": false, "properties": { "bruteForceDetection": { "items": { "additionalProperties": false, "properties": { "bruteForceStrategy": { "type": [ "string", "null" ] }, "failureResetTimeSeconds": { "description": "When will failure count be reset?", "type": [ "number", "null" ] }, "maxFailureWaitSeconds": { "type": [ "number", "null" ] }, "maxLoginFailures": { "description": "How many failures before wait is triggered.", "type": [ "number", "null" ] }, "maxTemporaryLockouts": { "description": "How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0", "type": [ "number", "null" ] }, "minimumQuickLoginWaitSeconds": { "description": "How long to wait after a quick login failure.", "type": [ "number", "null" ] }, "permanentLockout": { "description": "When true, this will lock the user permanently when the user exceeds the maximum login failures.", "type": [ "boolean", "null" ] }, "quickLoginCheckMilliSeconds": { "description": "Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.", "type": [ "number", "null" ] }, "waitIncrementSeconds": { "description": "This represents the amount of time a user should be locked out when the login failure threshold has been met.", "type": [ "number", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "headers": { "items": { "additionalProperties": false, "properties": { "contentSecurityPolicy": { "description": "Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.", "type": [ "string", "null" ] }, "contentSecurityPolicyReportOnly": { "description": "Used for testing Content Security Policies.", "type": [ "string", "null" ] }, "referrerPolicy": { "description": "The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.", "type": [ "string", "null" ] }, "strictTransportSecurity": { "description": "The Script-Transport-Security HTTP header tells browsers to always use HTTPS.", "type": [ "string", "null" ] }, "xContentTypeOptions": { "description": "Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type", "type": [ "string", "null" ] }, "xFrameOptions": { "description": "Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034", "type": [ "string", "null" ] }, "xRobotsTag": { "description": "Prevent pages from appearing in search engines.", "type": [ "string", "null" ] }, "xXssProtection": { "description": "This header configures the Cross-site scripting (XSS) filter in your browser.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "smtpServer": { "items": { "additionalProperties": false, "properties": { "allowUtf8": { "description": "When true, allows UTF-8 in the local part of the email address. Defaults to false.", "type": [ "boolean", "null" ] }, "auth": { "description": "Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "passwordSecretRef": { "additionalProperties": false, "description": "The SMTP server password.", "properties": { "key": { "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" } }, "required": [ "key", "name" ], "type": "object" }, "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "required": [ "passwordSecretRef" ], "type": "object" }, "type": [ "array", "null" ] }, "envelopeFrom": { "description": "The email address uses for bounces.", "type": [ "string", "null" ] }, "from": { "description": "The email address for the sender.", "type": [ "string", "null" ] }, "fromDisplayName": { "description": "The display name of the sender email address.", "type": [ "string", "null" ] }, "host": { "description": "The host of the SMTP server.", "type": [ "string", "null" ] }, "port": { "description": "The port of the SMTP server (defaults to 25).", "type": [ "string", "null" ] }, "replyTo": { "description": "The \"reply to\" email address.", "type": [ "string", "null" ] }, "replyToDisplayName": { "description": "The display name of the \"reply to\" email address.", "type": [ "string", "null" ] }, "ssl": { "description": "When true, enables SSL. Defaults to false.", "type": [ "boolean", "null" ] }, "starttls": { "description": "When true, enables StartTLS. Defaults to false.", "type": [ "boolean", "null" ] }, "tokenAuth": { "description": "Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "clientId": { "description": "The auth token client ID.", "type": [ "string", "null" ] }, "clientSecretSecretRef": { "additionalProperties": false, "description": "The auth token client secret.", "properties": { "key": { "type": "string" }, "name": { "description": "Name of the secret.", "type": "string" } }, "required": [ "key", "name" ], "type": "object" }, "scope": { "description": "The auth token scope.", "type": [ "string", "null" ] }, "url": { "description": "The auth token URL.", "type": [ "string", "null" ] }, "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "required": [ "clientSecretSecretRef" ], "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "sslRequired": { "description": "Can be one of following values: 'none, 'external' or 'all'\nSSL Required: Values can be 'none', 'external' or 'all'.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeoutRememberMe": { "description": "Similar to sso_session_idle_timeout, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_idle_timeout.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespanRememberMe": { "description": "Similar to sso_session_max_lifespan, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_max_lifespan.", "type": [ "string", "null" ] }, "terraformDeletionProtection": { "description": "When set to true, the realm cannot be deleted. Defaults to false.", "type": [ "boolean", "null" ] }, "userManagedAccess": { "description": "When true, users are allowed to manage their own resources. Defaults to false.", "type": [ "boolean", "null" ] }, "verifyEmail": { "description": "When true, users are required to verify their email address after registration and after email address changes.", "type": [ "boolean", "null" ] }, "webAuthnPasswordlessPolicy": { "description": "Configuration for WebAuthn Passwordless Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "passwordlessPasskeysEnabled": { "description": "When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.\nEnable passkeys for passwordless WebAuthn authentication", "type": [ "boolean", "null" ] }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "webAuthnPolicy": { "description": "Configuration for WebAuthn Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "managementPolicies": { "default": [ "*" ], "description": "THIS IS A BETA FIELD. It is on by default but can be opted out\nthrough a Crossplane feature flag.\nManagementPolicies specify the array of actions Crossplane is allowed to\ntake on the managed and external resources.\nSee the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223\nand this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md", "items": { "description": "A ManagementAction represents an action that the Crossplane controllers\ncan take on an external resource.", "enum": [ "Observe", "Create", "Update", "Delete", "LateInitialize", "*" ], "type": "string" }, "type": [ "array", "null" ] }, "providerConfigRef": { "additionalProperties": false, "default": { "kind": "ClusterProviderConfig", "name": "default" }, "description": "ProviderConfigReference specifies how the provider that will be used to\ncreate, observe, update, and delete this managed resource should be\nconfigured.", "properties": { "kind": { "description": "Kind of the referenced object.", "type": "string" }, "name": { "description": "Name of the referenced object.", "type": "string" } }, "required": [ "kind", "name" ], "type": [ "object", "null" ] }, "writeConnectionSecretToRef": { "additionalProperties": false, "description": "WriteConnectionSecretToReference specifies the namespace and name of a\nSecret to which any connection details for this managed resource should\nbe written. Connection details frequently include the endpoint, username,\nand password required to connect to the managed resource.", "properties": { "name": { "description": "Name of the secret.", "type": "string" } }, "required": [ "name" ], "type": [ "object", "null" ] } }, "required": [ "forProvider" ], "type": "object", "x-kubernetes-validations": [ { "message": "spec.forProvider.realm is a required parameter", "rule": "!('*' in self.managementPolicies || 'Create' in self.managementPolicies || 'Update' in self.managementPolicies) || has(self.forProvider.realm) || (has(self.initProvider) \u0026\u0026 has(self.initProvider.realm))" } ] }, "status": { "additionalProperties": false, "description": "RealmStatus defines the observed state of Realm.", "properties": { "atProvider": { "additionalProperties": false, "properties": { "accessCodeLifespan": { "description": "The maximum amount of time a client has to finish the authorization code flow.", "type": [ "string", "null" ] }, "accessCodeLifespanLogin": { "description": "The maximum amount of time a user is permitted to stay on the login page before the authentication process must be restarted.", "type": [ "string", "null" ] }, "accessCodeLifespanUserAction": { "description": "The maximum amount of time a user has to complete login related actions, such as updating a password.", "type": [ "string", "null" ] }, "accessTokenLifespan": { "description": "The amount of time an access token can be used before it expires.", "type": [ "string", "null" ] }, "accessTokenLifespanForImplicitFlow": { "description": "The amount of time an access token issued with the OpenID Connect Implicit Flow can be used before it expires.", "type": [ "string", "null" ] }, "accountTheme": { "description": "Used for account management pages.", "type": [ "string", "null" ] }, "actionTokenGeneratedByAdminLifespan": { "description": "The maximum time a user has to use an admin-generated permit before it expires.", "type": [ "string", "null" ] }, "actionTokenGeneratedByUserLifespan": { "description": "The maximum time a user has to use a user-generated permit before it expires.", "type": [ "string", "null" ] }, "adminPermissionsEnabled": { "description": "Enables the use of fine grained permissions v2", "type": [ "boolean", "null" ] }, "adminTheme": { "description": "Used for the admin console.", "type": [ "string", "null" ] }, "attributes": { "additionalProperties": { "type": "string" }, "description": "A map of custom attributes to add to the realm.", "type": [ "object", "null" ], "x-kubernetes-map-type": "granular" }, "browserFlow": { "description": "The desired flow for browser authentication. Defaults to browser.\nWhich flow should be used for BrowserFlow", "type": [ "string", "null" ] }, "clientAuthenticationFlow": { "description": "The desired flow for client authentication. Defaults to clients.\nWhich flow should be used for ClientAuthenticationFlow", "type": [ "string", "null" ] }, "clientSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires. Users can override it for individual clients.", "type": [ "string", "null" ] }, "clientSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity. Users can override it for individual clients.", "type": [ "string", "null" ] }, "defaultDefaultClientScopes": { "description": "A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultOptionalClientScopes": { "description": "A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "defaultSignatureAlgorithm": { "description": "Default algorithm used to sign tokens for the realm.", "type": [ "string", "null" ] }, "directGrantFlow": { "description": "The desired flow for direct access authentication. Defaults to direct grant.\nWhich flow should be used for DirectGrantFlow", "type": [ "string", "null" ] }, "displayName": { "description": "The display name for the realm that is shown when logging in to the admin console.", "type": [ "string", "null" ] }, "displayNameHtml": { "description": "The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.", "type": [ "string", "null" ] }, "dockerAuthenticationFlow": { "description": "The desired flow for Docker authentication. Defaults to docker auth.\nWhich flow should be used for DockerAuthenticationFlow", "type": [ "string", "null" ] }, "duplicateEmailsAllowed": { "description": "When true, multiple users will be allowed to have the same email address. This argument must be set to false if login_with_email_allowed is set to true.", "type": [ "boolean", "null" ] }, "editUsernameAllowed": { "description": "When true, the username field is editable.", "type": [ "boolean", "null" ] }, "emailTheme": { "description": "Used for emails that are sent by Keycloak.", "type": [ "string", "null" ] }, "enabled": { "description": "When false, users and clients will not be able to access this realm. Defaults to true.", "type": [ "boolean", "null" ] }, "firstBrokerLoginFlow": { "description": "The desired flow for First Broker Login (since Keycloak 24). Defaults to first broker login.\nWhich flow should be used for FirstBrokerLoginFlow", "type": [ "string", "null" ] }, "id": { "type": [ "string", "null" ] }, "internalId": { "description": "When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.", "type": [ "string", "null" ] }, "internationalization": { "items": { "additionalProperties": false, "properties": { "defaultLocale": { "description": "The locale to use by default. This locale code must be present within the supported_locales list.", "type": [ "string", "null" ] }, "supportedLocales": { "description": "A list of ISO 639-1 locale codes that the realm should support.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" } }, "type": "object" }, "type": [ "array", "null" ] }, "loginTheme": { "description": "Used for the login, forgot password, and registration pages.", "type": [ "string", "null" ] }, "loginWithEmailAllowed": { "description": "When true, users may log in with their email address.", "type": [ "boolean", "null" ] }, "oauth2DeviceCodeLifespan": { "description": "The maximum amount of time a client has to finish the device code flow before it expires.", "type": [ "string", "null" ] }, "oauth2DevicePollingInterval": { "description": "The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.", "type": [ "number", "null" ] }, "offlineSessionIdleTimeout": { "description": "The amount of time an offline session can be idle before it expires.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespan": { "description": "The maximum amount of time before an offline session expires regardless of activity.", "type": [ "string", "null" ] }, "offlineSessionMaxLifespanEnabled": { "description": "Enable offline_session_max_lifespan.", "type": [ "boolean", "null" ] }, "organizationsEnabled": { "description": "When true, organization support is enabled. Defaults to false.", "type": [ "boolean", "null" ] }, "otpPolicy": { "items": { "additionalProperties": false, "properties": { "algorithm": { "description": "What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.\nWhat hashing algorithm should be used to generate the OTP.", "type": [ "string", "null" ] }, "codeReusable": { "description": "Possibility to use the same OTP code again after successful authentication. Defaults to false.", "type": [ "boolean", "null" ] }, "digits": { "description": "How many digits the OTP have. Defaults to 6.", "type": [ "number", "null" ] }, "initialCounter": { "description": "What should the initial counter value be. Defaults to 2.", "type": [ "number", "null" ] }, "lookAheadWindow": { "description": "How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.", "type": [ "number", "null" ] }, "period": { "description": "How many seconds should an OTP token be valid. Defaults to 30.", "type": [ "number", "null" ] }, "type": { "description": "One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.\nOTP Type, totp for Time-Based One Time Password or hotp for counter base one time password", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "passwordPolicy": { "description": "The password policy for users within the realm.\nString that represents the passwordPolicies that are in place. Each policy is separated with \" and \". Supported policies can be found in the server-info providers page. example: \"upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)\"", "type": [ "string", "null" ] }, "realm": { "description": "The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.", "type": [ "string", "null" ] }, "refreshTokenMaxReuse": { "description": "Maximum number of times a refresh token can be reused before they are revoked. If unspecified and 'revoke_refresh_token' is enabled the default value is 0 and refresh tokens can not be reused.", "type": [ "number", "null" ] }, "registrationAllowed": { "description": "When true, user registration will be enabled, and a link for registration will be displayed on the login page.", "type": [ "boolean", "null" ] }, "registrationEmailAsUsername": { "description": "When true, the user's email will be used as their username during registration.", "type": [ "boolean", "null" ] }, "registrationFlow": { "description": "The desired flow for user registration. Defaults to registration.\nWhich flow should be used for RegistrationFlow", "type": [ "string", "null" ] }, "rememberMe": { "description": "When true, a \"remember me\" checkbox will be displayed on the login page, and the user's session will not expire between browser restarts.", "type": [ "boolean", "null" ] }, "resetCredentialsFlow": { "description": "The desired flow to use when a user attempts to reset their credentials. Defaults to reset credentials.\nWhich flow should be used for ResetCredentialsFlow", "type": [ "string", "null" ] }, "resetPasswordAllowed": { "description": "When true, a \"forgot password\" link will be displayed on the login page.", "type": [ "boolean", "null" ] }, "revokeRefreshToken": { "description": "If enabled a refresh token can only be used number of times specified in 'refresh_token_max_reuse' before they are revoked. If unspecified, refresh tokens can be reused.", "type": [ "boolean", "null" ] }, "securityDefenses": { "items": { "additionalProperties": false, "properties": { "bruteForceDetection": { "items": { "additionalProperties": false, "properties": { "bruteForceStrategy": { "type": [ "string", "null" ] }, "failureResetTimeSeconds": { "description": "When will failure count be reset?", "type": [ "number", "null" ] }, "maxFailureWaitSeconds": { "type": [ "number", "null" ] }, "maxLoginFailures": { "description": "How many failures before wait is triggered.", "type": [ "number", "null" ] }, "maxTemporaryLockouts": { "description": "How many temporary lockouts are permitted before a user is permanently locked out. permanent_lockout needs to be true. Defaults to 0", "type": [ "number", "null" ] }, "minimumQuickLoginWaitSeconds": { "description": "How long to wait after a quick login failure.", "type": [ "number", "null" ] }, "permanentLockout": { "description": "When true, this will lock the user permanently when the user exceeds the maximum login failures.", "type": [ "boolean", "null" ] }, "quickLoginCheckMilliSeconds": { "description": "Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.", "type": [ "number", "null" ] }, "waitIncrementSeconds": { "description": "This represents the amount of time a user should be locked out when the login failure threshold has been met.", "type": [ "number", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "headers": { "items": { "additionalProperties": false, "properties": { "contentSecurityPolicy": { "description": "Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.", "type": [ "string", "null" ] }, "contentSecurityPolicyReportOnly": { "description": "Used for testing Content Security Policies.", "type": [ "string", "null" ] }, "referrerPolicy": { "description": "The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.", "type": [ "string", "null" ] }, "strictTransportSecurity": { "description": "The Script-Transport-Security HTTP header tells browsers to always use HTTPS.", "type": [ "string", "null" ] }, "xContentTypeOptions": { "description": "Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type", "type": [ "string", "null" ] }, "xFrameOptions": { "description": "Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034", "type": [ "string", "null" ] }, "xRobotsTag": { "description": "Prevent pages from appearing in search engines.", "type": [ "string", "null" ] }, "xXssProtection": { "description": "This header configures the Cross-site scripting (XSS) filter in your browser.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "smtpServer": { "items": { "additionalProperties": false, "properties": { "allowUtf8": { "description": "When true, allows UTF-8 in the local part of the email address. Defaults to false.", "type": [ "boolean", "null" ] }, "auth": { "description": "Enables authentication to the SMTP server. Cannot be set alongside token_auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "envelopeFrom": { "description": "The email address uses for bounces.", "type": [ "string", "null" ] }, "from": { "description": "The email address for the sender.", "type": [ "string", "null" ] }, "fromDisplayName": { "description": "The display name of the sender email address.", "type": [ "string", "null" ] }, "host": { "description": "The host of the SMTP server.", "type": [ "string", "null" ] }, "port": { "description": "The port of the SMTP server (defaults to 25).", "type": [ "string", "null" ] }, "replyTo": { "description": "The \"reply to\" email address.", "type": [ "string", "null" ] }, "replyToDisplayName": { "description": "The display name of the \"reply to\" email address.", "type": [ "string", "null" ] }, "ssl": { "description": "When true, enables SSL. Defaults to false.", "type": [ "boolean", "null" ] }, "starttls": { "description": "When true, enables StartTLS. Defaults to false.", "type": [ "boolean", "null" ] }, "tokenAuth": { "description": "Enables authentication to the SMTP server through OAUTH2. Cannot be set alongside auth. This block supports the following arguments:", "items": { "additionalProperties": false, "properties": { "clientId": { "description": "The auth token client ID.", "type": [ "string", "null" ] }, "scope": { "description": "The auth token scope.", "type": [ "string", "null" ] }, "url": { "description": "The auth token URL.", "type": [ "string", "null" ] }, "username": { "description": "The SMTP server username.", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "sslRequired": { "description": "Can be one of following values: 'none, 'external' or 'all'\nSSL Required: Values can be 'none', 'external' or 'all'.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeout": { "description": "The amount of time a session can be idle before it expires.", "type": [ "string", "null" ] }, "ssoSessionIdleTimeoutRememberMe": { "description": "Similar to sso_session_idle_timeout, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_idle_timeout.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespan": { "description": "The maximum amount of time before a session expires regardless of activity.", "type": [ "string", "null" ] }, "ssoSessionMaxLifespanRememberMe": { "description": "Similar to sso_session_max_lifespan, but used when a user clicks \"Remember Me\". If not set, Keycloak will default to the value of sso_session_max_lifespan.", "type": [ "string", "null" ] }, "terraformDeletionProtection": { "description": "When set to true, the realm cannot be deleted. Defaults to false.", "type": [ "boolean", "null" ] }, "userManagedAccess": { "description": "When true, users are allowed to manage their own resources. Defaults to false.", "type": [ "boolean", "null" ] }, "verifyEmail": { "description": "When true, users are required to verify their email address after registration and after email address changes.", "type": [ "boolean", "null" ] }, "webAuthnPasswordlessPolicy": { "description": "Configuration for WebAuthn Passwordless Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "passwordlessPasskeysEnabled": { "description": "When true, Keycloak will enable passwordless passkey support. This attribute is only valid inside a web_authn_passwordless_policy block and requires a Keycloak version that supports passwordless passkeys. Defaults to false.\nEnable passkeys for passwordless WebAuthn authentication", "type": [ "boolean", "null" ] }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] }, "webAuthnPolicy": { "description": "Configuration for WebAuthn Policy authentication.", "items": { "additionalProperties": false, "properties": { "acceptableAaguids": { "description": "A set of AAGUIDs for which an authenticator can be registered.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "attestationConveyancePreference": { "description": "The preference of how to generate a WebAuthn attestation statement. Valid options are not specified, none, indirect, direct, or enterprise. Defaults to not specified.\nEither none, indirect or direct", "type": [ "string", "null" ] }, "authenticatorAttachment": { "description": "The acceptable attachment pattern for the WebAuthn authenticator. Valid options are not specified, platform, or cross-platform. Defaults to not specified.\nEither platform or cross-platform", "type": [ "string", "null" ] }, "avoidSameAuthenticatorRegister": { "description": "When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.", "type": [ "boolean", "null" ] }, "createTimeout": { "description": "The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.", "type": [ "number", "null" ] }, "discoverableCredential": { "description": "The extent to which the authenticator should create a client-side discoverable credential (resident key). Valid options are not specified, required, preferred, or discouraged. Defaults to not specified. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.\nEither required, preferred or discouraged. Replaces and takes precedence over the deprecated require_resident_key attribute. Requires Keycloak 26.7 or higher.", "type": [ "string", "null" ] }, "extraOrigins": { "description": "A set of extra origins for non-web applications.", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "relyingPartyEntityName": { "description": "A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.", "type": [ "string", "null" ] }, "relyingPartyId": { "description": "The WebAuthn relying party ID.", "type": [ "string", "null" ] }, "requireResidentKey": { "description": "Deprecated Specifies whether a public key should be created to represent the resident key. Valid options are not specified, Yes, or No. Defaults to not specified. Deprecated by Keycloak in favor of discoverable_credential — this attribute is only used when discoverable_credential is left as not specified.\nEither Yes or No", "type": [ "string", "null" ] }, "signatureAlgorithms": { "description": "A set of signature algorithms that should be used for the authentication assertion. Valid options at the time these docs were written are ES256, ES384, ES512, RS256, RS384, RS512, and RS1.\nKeycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing", "items": { "type": "string" }, "type": [ "array", "null" ], "x-kubernetes-list-type": "set" }, "userVerificationRequirement": { "description": "Specifies the policy for verifying a user logging in via WebAuthn. Valid options are not specified, required, preferred, or discouraged. Defaults to not specified.\nEither required, preferred or discouraged", "type": [ "string", "null" ] } }, "type": "object" }, "type": [ "array", "null" ] } }, "type": [ "object", "null" ] }, "conditions": { "description": "Conditions of the resource.", "items": { "additionalProperties": false, "description": "A Condition that may apply to a resource.", "properties": { "lastTransitionTime": { "description": "LastTransitionTime is the last time this condition transitioned from one\nstatus to another.", "format": "date-time", "type": "string" }, "message": { "description": "A Message containing details about this condition's last transition from\none status to another, if any.", "type": [ "string", "null" ] }, "observedGeneration": { "description": "ObservedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "type": [ "integer", "null" ] }, "reason": { "description": "A Reason for this condition's last transition from one status to another.", "type": "string" }, "status": { "description": "Status of this condition; is it currently True, False, or Unknown?", "type": "string" }, "type": { "description": "Type of this condition. At most one of each condition type may apply to\na resource at any point in time.", "type": "string" } }, "required": [ "lastTransitionTime", "reason", "status", "type" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "description": "ObservedGeneration is the latest metadata.generation\nwhich resulted in either a ready state, or stalled due to error\nit can not recover from without human intervention.", "format": "int64", "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "spec" ], "type": "object" }