Management API Reference for realm

Configuration for a Keycloak realm. If you have multiple deployments secured by the same realm you can share the realm configuration here.

Stability Level: default

Attributes (42)

allow-any-hostname - If set to 'true', hostname verification will be skipped when communicating with Keycloak over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If set to 'true', hostname verification will be skipped when communicating with Keycloak over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

always-refresh-token - If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to Keycloak to obtain a new access token. This can result in a higher load on the Keycloak and may impact the performance of the application.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to Keycloak to obtain a new access token. This can result in a higher load on the Keycloak and may impact the performance of the application.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

auth-server-url - The base URL of the Keycloak authorization server. It is recommended to use the 'provider-url' instead.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The base URL of the Keycloak authorization server. It is recommended to use the 'provider-url' instead.", "expressions-allowed" : true, "required" : false, "nillable" : true, "alternatives" : ["provider-url"], "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 authentication-request-format - The format to use for specifying query parameters in authentication request.

Type	STRING
Default Value	oauth2
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Allowed Values	request oauth2 request_uri
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The format to use for specifying query parameters in authentication request.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "oauth2", "allowed" : [ "request_uri", "oauth2", "request" ], "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

autodetect-bearer-only - Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the Keycloak login page. Set the value to 'true' if your application serves both applications and web services.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the Keycloak login page. Set the value to 'true' if your application serves both applications and web services.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

client-key-password - The password for the client key. This is required if 'client-keystore' has been specified.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The password for the client key. This is required if 'client-keystore' has been specified.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

client-keystore - The path to the client keystore to use when communicating with Keycloak over HTTPS. This is optional.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The path to the client keystore to use when communicating with Keycloak over HTTPS. This is optional.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

client-keystore-password - The password for the client keystore. This is required if 'client-keystore' has been specified.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The password for the client keystore. This is required if 'client-keystore' has been specified.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

confidential-port - The confidential port used by Keycloak when communicating securely over SSL/TLS.

Type	INT
Default Value	8443
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "The confidential port used by Keycloak when communicating securely over SSL/TLS.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : 8443, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

connection-pool-size - The connection pool size to use when communicating with Keycloak.

Type	INT
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	0
Max	2147483647
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "The connection pool size to use when communicating with Keycloak.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : 0, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

connection-timeout-millis - The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.

Type	LONG
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "LONG" }, "description" : "The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

connection-ttl-millis - The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.

Type	LONG
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "LONG" }, "description" : "The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

cors-allowed-headers - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

cors-allowed-methods - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

cors-exposed-headers - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

cors-max-age - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.

Type	INT
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

disable-trust-manager - Whether or not to make use of a trust manager when communicating with Keycloak over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Whether or not to make use of a trust manager when communicating with Keycloak over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

enable-cors - Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

expose-token - If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

ignore-oauth-query-parameter - Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

principal-attribute - Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

provider-jwt-claims-typ - The OpenID Provider's JWT Logout Token "typ" string, if it is different from "logout+jwt".

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The OpenID Provider's JWT Logout Token \"typ\" string, if it is different from \"logout+jwt\".", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

provider-url - The OpenID provider URL.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The OpenID provider URL.", "expressions-allowed" : true, "required" : false, "nillable" : true, "alternatives" : ["auth-server-url"], "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

proxy-url - The URL for the HTTP proxy if one is used.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The URL for the HTTP proxy if one is used.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

realm-public-key - The public key of the Keycloak realm in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from Keycloak when needed. If the public key is set, the subsystem never downloads new keys from Keycloak, breaking the subsystem when Keycloak rotates its keys.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The public key of the Keycloak realm in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from Keycloak when needed. If the public key is set, the subsystem never downloads new keys from Keycloak, breaking the subsystem when Keycloak rotates its keys.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

register-node-at-startup - If set to 'true', the subsystem sends a registration request to Keycloak. This attribute is useful only when your application is clustered.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If set to 'true', the subsystem sends a registration request to Keycloak. This attribute is useful only when your application is clustered.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

register-node-period - If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.

Type	INT
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "INT" }, "description" : "If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-encryption-alg-value - The encryption algorithm used to encrypt the request object.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The encryption algorithm used to encrypt the request object.", "expressions-allowed" : true, "required" : false, "nillable" : true, "requires" : ["request-object-encryption-enc-value"], "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-encryption-enc-value - The content encryption algorithm used to encrypt the request object.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The content encryption algorithm used to encrypt the request object.", "expressions-allowed" : true, "required" : false, "nillable" : true, "requires" : ["request-object-encryption-alg-value"], "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-algorithm - The algorithm used to sign the request object. The default value fot this attribute is "none".

Type	STRING
Default Value	none
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The algorithm used to sign the request object. The default value fot this attribute is \"none\".", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "none", "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-key-alias - The key alias when a key pair is used to sign request objects.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The key alias when a key pair is used to sign request objects.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-key-password - The key password when a key pair is used to sign request objects.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The key password when a key pair is used to sign request objects.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-keystore-file - The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-keystore-password - The keystore password when a key pair is used to sign request objects.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The keystore password when a key pair is used to sign request objects.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

🅲 request-object-signing-keystore-type - The keystore type used to specify the client key pair used to sign request objects.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	community
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The keystore type used to specify the client key pair used to sign request objects.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "community", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

socket-timeout-millis - The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.

Type	LONG
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Min	-1
Max	2147483647
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "LONG" }, "description" : "The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min" : -1, "max" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

ssl-required - Whether the communication with Keycloak should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.

Type	STRING
Default Value	external
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Allowed Values	ALL EXTERNAL NONE
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "Whether the communication with Keycloak should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "external", "allowed" : [ "ALL", "EXTERNAL", "NONE" ], "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

token-signature-algorithm - The token signature algorithm used by Keycloak.

Type	STRING
Default Value	RS256
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The token signature algorithm used by Keycloak.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : "RS256", "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

token-store - Defines whether to store account information in an HTTP session or in a cookie.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "Defines whether to store account information in an HTTP session or in a cookie.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

truststore - The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

truststore-password - The password for the truststore.

Type	STRING
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	`{ "type" : { "TYPE_MODEL_VALUE" : "STRING" }, "description" : "The password for the truststore.", "expressions-allowed" : true, "required" : false, "nillable" : true, "min-length" : 1, "max-length" : 2147483647, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }`

verify-token-audience - If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set to 'true' for improved security.

Type	BOOLEAN
Default Value	false
Is the attribute nillable?	true
Does the attribute allow expression?	true
Where is the attribute stored?	configuration
Access Type	read-write
Is restarted required?	no-services
Stability Level	default
Raw DMR model	{ "type" : { "TYPE_MODEL_VALUE" : "BOOLEAN" }, "description" : "If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set to 'true' for improved security.", "expressions-allowed" : true, "required" : false, "nillable" : true, "default" : false, "stability" : "default", "access-type" : "read-write", "storage" : "configuration", "restart-required" : "no-services", "capability-reference" : null }

Operations (2)

add - Add a Keycloak realm definition to the subsystem.

Request Parameter	Type	Required	Expressions Allowed	Default value	Description
allow-any-hostname	BOOLEAN	false	true	false	If set to 'true', hostname verification will be skipped when communicating with Keycloak over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.
always-refresh-token	BOOLEAN	false	true	false	If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to Keycloak to obtain a new access token. This can result in a higher load on the Keycloak and may impact the performance of the application.
auth-server-url	STRING	false	true		The base URL of the Keycloak authorization server. It is recommended to use the 'provider-url' instead.
authentication-request-format	STRING	false	true	oauth2	The format to use for specifying query parameters in authentication request.
autodetect-bearer-only	BOOLEAN	false	true	false	Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the Keycloak login page. Set the value to 'true' if your application serves both applications and web services.
client-key-password	STRING	false	true		The password for the client key. This is required if 'client-keystore' has been specified.
client-keystore	STRING	false	true		The path to the client keystore to use when communicating with Keycloak over HTTPS. This is optional.
client-keystore-password	STRING	false	true		The password for the client keystore. This is required if 'client-keystore' has been specified.
confidential-port	INT	false	true	8443	The confidential port used by Keycloak when communicating securely over SSL/TLS.
connection-pool-size	INT	false	true		The connection pool size to use when communicating with Keycloak.
connection-timeout-millis	LONG	false	true		The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.
connection-ttl-millis	LONG	false	true		The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.
cors-allowed-headers	STRING	false	true		If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
cors-allowed-methods	STRING	false	true		If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
cors-exposed-headers	STRING	false	true		If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
cors-max-age	INT	false	true		If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.
disable-trust-manager	BOOLEAN	false	true	false	Whether or not to make use of a trust manager when communicating with Keycloak over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.
enable-cors	BOOLEAN	false	true	false	Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional.
expose-token	BOOLEAN	false	true	false	If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.
ignore-oauth-query-parameter	BOOLEAN	false	true	false	Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.
principal-attribute	STRING	false	true		Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.
provider-jwt-claims-typ	STRING	false	true		The OpenID Provider's JWT Logout Token "typ" string, if it is different from "logout+jwt".
provider-url	STRING	false	true		The OpenID provider URL.
proxy-url	STRING	false	true		The URL for the HTTP proxy if one is used.
realm-public-key	STRING	false	true		The public key of the Keycloak realm in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from Keycloak when needed. If the public key is set, the subsystem never downloads new keys from Keycloak, breaking the subsystem when Keycloak rotates its keys.
register-node-at-startup	BOOLEAN	false	true	false	If set to 'true', the subsystem sends a registration request to Keycloak. This attribute is useful only when your application is clustered.
register-node-period	INT	false	true		If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.
request-object-encryption-alg-value	STRING	false	true		The encryption algorithm used to encrypt the request object.
request-object-encryption-enc-value	STRING	false	true		The content encryption algorithm used to encrypt the request object.
request-object-signing-algorithm	STRING	false	true	none	The algorithm used to sign the request object. The default value fot this attribute is "none".
request-object-signing-key-alias	STRING	false	true		The key alias when a key pair is used to sign request objects.
request-object-signing-key-password	STRING	false	true		The key password when a key pair is used to sign request objects.
request-object-signing-keystore-file	STRING	false	true		The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.
request-object-signing-keystore-password	STRING	false	true		The keystore password when a key pair is used to sign request objects.
request-object-signing-keystore-type	STRING	false	true		The keystore type used to specify the client key pair used to sign request objects.
socket-timeout-millis	LONG	false	true		The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.
ssl-required	STRING	false	true	external	Whether the communication with Keycloak should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.
token-signature-algorithm	STRING	false	true	RS256	The token signature algorithm used by Keycloak.
token-store	STRING	false	true		Defines whether to store account information in an HTTP session or in a cookie.
truststore	STRING	false	true		The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.
truststore-password	STRING	false	true		The password for the truststore.
verify-token-audience	BOOLEAN	false	true	false	If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set to 'true' for improved security.

Raw DMR model


{
    "operation-name" : "add",
    "description" : "Add a Keycloak realm definition to the subsystem.",
    "request-properties" : {
        "allow-any-hostname" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If set to 'true', hostname verification will be skipped when communicating with Keycloak over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "always-refresh-token" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to Keycloak to obtain a new access token. This can result in a higher load on the Keycloak and may impact the performance of the application.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "auth-server-url" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The base URL of the Keycloak authorization server. It is recommended to use the 'provider-url' instead.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "alternatives" : ["provider-url"],
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "authentication-request-format" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The format to use for specifying query parameters in authentication request.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "oauth2",
            "allowed" : [
                "request_uri",
                "oauth2",
                "request"
            ],
            "stability" : "community"
        },
        "autodetect-bearer-only" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the Keycloak login page. Set the value to 'true' if your application serves both applications and web services.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "client-key-password" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The password for the client key. This is required if 'client-keystore' has been specified.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "client-keystore" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The path to the client keystore to use when communicating with Keycloak over HTTPS. This is optional.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "client-keystore-password" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The password for the client keystore. This is required if 'client-keystore' has been specified.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "confidential-port" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "The confidential port used by Keycloak when communicating securely over SSL/TLS.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : 8443,
            "stability" : "default"
        },
        "connection-pool-size" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "The connection pool size to use when communicating with Keycloak.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : 0,
            "max" : 2147483647,
            "stability" : "default"
        },
        "connection-timeout-millis" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "LONG"
            },
            "description" : "The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "connection-ttl-millis" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "LONG"
            },
            "description" : "The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "cors-allowed-headers" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "cors-allowed-methods" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "cors-exposed-headers" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "cors-max-age" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "disable-trust-manager" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Whether or not to make use of a trust manager when communicating with Keycloak over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "enable-cors" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "expose-token" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "ignore-oauth-query-parameter" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "principal-attribute" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "provider-jwt-claims-typ" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The OpenID Provider's JWT Logout Token \"typ\" string, if it is different from \"logout+jwt\".",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "provider-url" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The OpenID provider URL.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "alternatives" : ["auth-server-url"],
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "proxy-url" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The URL for the HTTP proxy if one is used.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "realm-public-key" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The public key of the Keycloak realm in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from Keycloak when needed. If the public key is set, the subsystem never downloads new keys from Keycloak, breaking the subsystem when Keycloak rotates its keys.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "register-node-at-startup" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If set to 'true', the subsystem sends a registration request to Keycloak. This attribute is useful only when your application is clustered.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        },
        "register-node-period" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "INT"
            },
            "description" : "If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "request-object-encryption-alg-value" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The encryption algorithm used to encrypt the request object.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "requires" : ["request-object-encryption-enc-value"],
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-encryption-enc-value" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The content encryption algorithm used to encrypt the request object.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "requires" : ["request-object-encryption-alg-value"],
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-algorithm" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The algorithm used to sign the request object. The default value fot this attribute is \"none\".",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "none",
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-key-alias" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The key alias when a key pair is used to sign request objects.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-key-password" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The key password when a key pair is used to sign request objects.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-keystore-file" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-keystore-password" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The keystore password when a key pair is used to sign request objects.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "request-object-signing-keystore-type" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The keystore type used to specify the client key pair used to sign request objects.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "community"
        },
        "socket-timeout-millis" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "LONG"
            },
            "description" : "The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min" : -1,
            "max" : 2147483647,
            "stability" : "default"
        },
        "ssl-required" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "Whether the communication with Keycloak should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "external",
            "allowed" : [
                "ALL",
                "EXTERNAL",
                "NONE"
            ],
            "stability" : "default"
        },
        "token-signature-algorithm" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The token signature algorithm used by Keycloak.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : "RS256",
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "token-store" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "Defines whether to store account information in an HTTP session or in a cookie.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "truststore" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "truststore-password" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "STRING"
            },
            "description" : "The password for the truststore.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "min-length" : 1,
            "max-length" : 2147483647,
            "stability" : "default"
        },
        "verify-token-audience" : {
            "type" : {
                "TYPE_MODEL_VALUE" : "BOOLEAN"
            },
            "description" : "If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set to 'true' for improved security.",
            "expressions-allowed" : true,
            "required" : false,
            "nillable" : true,
            "default" : false,
            "stability" : "default"
        }
    },
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

remove - Remove a Keycloak realm from the subsystem.

Raw DMR model


{
    "operation-name" : "remove",
    "description" : "Remove a Keycloak realm from the subsystem.",
    "request-properties" : {},
    "reply-properties" : {},
    "stability" : "default",
    "read-only" : false,
    "restart-required" : "resource-services",
    "runtime-only" : false
}

Galleon Features

Galleon features are to be used when creating Galleon feature-packs.

subsystem.elytron-oidc-client.realm

        
<feature spec="subsystem.elytron-oidc-client.realm">
  <param name="realm" value="{resource name}"/>
  <param name="allow-any-hostname" value="{value}"/>
  <param name="always-refresh-token" value="{value}"/>
  <param name="auth-server-url" value="{value}"/>
  <param name="authentication-request-format" value="{value}"/>
  <param name="autodetect-bearer-only" value="{value}"/>
  <param name="client-key-password" value="{value}"/>
  <param name="client-keystore" value="{value}"/>
  <param name="client-keystore-password" value="{value}"/>
  <param name="confidential-port" value="{value}"/>
  <param name="connection-pool-size" value="{value}"/>
  <param name="connection-timeout-millis" value="{value}"/>
  <param name="connection-ttl-millis" value="{value}"/>
  <param name="cors-allowed-headers" value="{value}"/>
  <param name="cors-allowed-methods" value="{value}"/>
  <param name="cors-exposed-headers" value="{value}"/>
  <param name="cors-max-age" value="{value}"/>
  <param name="disable-trust-manager" value="{value}"/>
  <param name="enable-cors" value="{value}"/>
  <param name="expose-token" value="{value}"/>
  <param name="ignore-oauth-query-parameter" value="{value}"/>
  <param name="principal-attribute" value="{value}"/>
  <param name="provider-jwt-claims-typ" value="{value}"/>
  <param name="provider-url" value="{value}"/>
  <param name="proxy-url" value="{value}"/>
  <param name="realm-public-key" value="{value}"/>
  <param name="register-node-at-startup" value="{value}"/>
  <param name="register-node-period" value="{value}"/>
  <param name="request-object-encryption-alg-value" value="{value}"/>
  <param name="request-object-encryption-enc-value" value="{value}"/>
  <param name="request-object-signing-algorithm" value="{value}"/>
  <param name="request-object-signing-key-alias" value="{value}"/>
  <param name="request-object-signing-key-password" value="{value}"/>
  <param name="request-object-signing-keystore-file" value="{value}"/>
  <param name="request-object-signing-keystore-password" value="{value}"/>
  <param name="request-object-signing-keystore-type" value="{value}"/>
  <param name="socket-timeout-millis" value="{value}"/>
  <param name="ssl-required" value="{value}"/>
  <param name="token-signature-algorithm" value="{value}"/>
  <param name="token-store" value="{value}"/>
  <param name="truststore" value="{value}"/>
  <param name="truststore-password" value="{value}"/>
  <param name="verify-token-audience" value="{value}"/>
<feature/>