keycloak.openid.Client

The amount of time in seconds before an access token expires. This will override the default for the realm.

AdminUrl string

URL to the admin interface of the client.

AuthenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

Authorization ClientAuthorization

When this block is present, fine-grained authorization will be enabled for this client. The client's access_type must be CONFIDENTIAL, and service_accounts_enabled must be true. This block has the following arguments:

Specifying whether a "revoke_offline_access" event is included in the Logout Token when the Backchannel Logout URL is used. Keycloak will revoke offline sessions when receiving a Logout Token with this event.

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

BaseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

ClientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

ClientSecret string

The secret for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. This value is sensitive and should be treated with the same care as a password. If omitted, this will be generated by Keycloak.

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

Description string

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

Enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

ExtraConfig Dictionary<string, string>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

Import bool

When true, the client with the specified client_id is assumed to already exist, and it will be imported into state instead of being created. This attribute is useful when dealing with clients that Keycloak creates automatically during realm creation, such as account and admin-cli. Note, that the client will not be removed during destruction if import is true.

LoginTheme string

The client login theme. This will override the default theme for the realm.

Name string

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

RootUrl string

When specified, this URL is prepended to any relative URLs found within valid_redirect_uris, web_origins, and admin_url. NOTE: Due to limitations in the Keycloak API, when the root_url attribute is used, the valid_redirect_uris, web_origins, and admin_url attributes will be required.

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

If this is true, a refresh_token will be created and added to the token response if the client_credentials grant is used and a user session will be created. If this is false then no refresh_token will be generated and the associated user session will be removed, in accordance with OAuth 2.0 RFC6749 Section 4.4.3. Defaults to false.

ValidPostLogoutRedirectUris List<string>

A list of valid URIs a browser is permitted to redirect to after a successful logout.

ValidRedirectUris List<string>

A list of valid URIs a browser is permitted to redirect to after a successful login or logout. Simple wildcards in the form of an asterisk can be used here. This attribute must be set if either standard_flow_enabled or implicit_flow_enabled is set to true.

WebOrigins List<string>

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

AccessType string

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

RealmId string

The realm this client is attached to.

The amount of time in seconds before an access token expires. This will override the default for the realm.

AdminUrl string

URL to the admin interface of the client.

AuthenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverridesArgs

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

Authorization ClientAuthorizationArgs

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

BaseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

ClientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

ClientSecret string

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

Description string

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

Enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

ExtraConfig map[string]string

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

Import bool

LoginTheme string

The client login theme. This will override the default theme for the realm.

Name string

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

RootUrl string

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

ValidPostLogoutRedirectUris []string

A list of valid URIs a browser is permitted to redirect to after a successful logout.

ValidRedirectUris []string

WebOrigins []string

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

accessType String

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

realmId String

The realm this client is attached to.

The amount of time in seconds before an access token expires. This will override the default for the realm.

adminUrl String

URL to the admin interface of the client.

authenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl String

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId String

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret String

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired Boolean

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description String

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled Boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig Map<String,String>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed Boolean

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import_ Boolean

loginTheme String

The client login theme. This will override the default theme for the realm.

name String

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

rootUrl String

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens Boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

authenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

validPostLogoutRedirectUris List<String>

A list of valid URIs a browser is permitted to redirect to after a successful logout.

validRedirectUris List<String>

webOrigins List<String>

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

accessType string

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

realmId string

The realm this client is attached to.

accessTokenLifespan string

The amount of time in seconds before an access token expires. This will override the default for the realm.

adminUrl string

URL to the admin interface of the client.

alwaysDisplayInConsole boolean

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authentication_flow_binding_overrides ClientAuthenticationFlowBindingOverridesArgs

backchannelLogoutRevokeOfflineSessions boolean

backchannelLogoutSessionRequired boolean

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

backchannelLogoutUrl string

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

clientAuthenticatorType string

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

clientOfflineSessionIdleTimeout string

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

clientOfflineSessionMaxLifespan string

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret string

clientSessionIdleTimeout string

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

clientSessionMaxLifespan string

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired boolean

When true, users have to consent to client access. Defaults to false.

consentScreenText string

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description string

The description of this client in the GUI.

directAccessGrantsEnabled boolean

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

displayOnConsentScreen boolean

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

excludeIssuerFromAuthResponse boolean

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

excludeSessionStateFromAuthResponse boolean

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig {[key: string]: string}

frontchannelLogoutEnabled boolean

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

frontchannelLogoutUrl string

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed boolean

Allow to include all roles mappings in the access token.

implicitFlowEnabled boolean

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import boolean

loginTheme string

The client login theme. This will override the default theme for the realm.

name string

The display name of this client in the GUI.

oauth2DeviceAuthorizationGrantEnabled boolean

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

oauth2DeviceCodeLifespan string

The maximum amount of time a client has to finish the device code flow before it expires.

oauth2DevicePollingInterval string

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

pkceCodeChallengeMethod string

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

rootUrl string

serviceAccountsEnabled boolean

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

standardFlowEnabled boolean

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

useRefreshTokensClientCredentials boolean

validPostLogoutRedirectUris string[]

A list of valid URIs a browser is permitted to redirect to after a successful logout.

validRedirectUris string[]

webOrigins string[]

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

access_type str

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

realm_id str

The realm this client is attached to.

access_token_lifespan str

The amount of time in seconds before an access token expires. This will override the default for the realm.

admin_url str

URL to the admin interface of the client.

always_display_in_console bool

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authorization ClientAuthorizationArgs

backchannel_logout_revoke_offline_sessions bool

backchannel_logout_session_required bool

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

backchannel_logout_url str

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

base_url str

Default URL to use when the auth server needs to redirect or link back to the client.

client_authenticator_type str

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

client_id str

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

client_offline_session_idle_timeout str

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

client_offline_session_max_lifespan str

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

client_secret str

client_session_idle_timeout str

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

client_session_max_lifespan str

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consent_required bool

When true, users have to consent to client access. Defaults to false.

consent_screen_text str

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description str

The description of this client in the GUI.

direct_access_grants_enabled bool

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

display_on_consent_screen bool

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

exclude_issuer_from_auth_response bool

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

exclude_session_state_from_auth_response bool

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extra_config Mapping[str, str]

frontchannel_logout_enabled bool

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

frontchannel_logout_url str

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

full_scope_allowed bool

Allow to include all roles mappings in the access token.

implicit_flow_enabled bool

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import_ bool

login_theme str

The client login theme. This will override the default theme for the realm.

name str

The display name of this client in the GUI.

oauth2_device_authorization_grant_enabled bool

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

oauth2_device_code_lifespan str

The maximum amount of time a client has to finish the device code flow before it expires.

oauth2_device_polling_interval str

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

pkce_code_challenge_method str

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

root_url str

service_accounts_enabled bool

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

standard_flow_enabled bool

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

use_refresh_tokens bool

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

use_refresh_tokens_client_credentials bool

valid_post_logout_redirect_uris Sequence[str]

A list of valid URIs a browser is permitted to redirect to after a successful logout.

valid_redirect_uris Sequence[str]

web_origins Sequence[str]

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

accessType String

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

realmId String

The realm this client is attached to.

The amount of time in seconds before an access token expires. This will override the default for the realm.

adminUrl String

URL to the admin interface of the client.

authenticationFlowBindingOverrides Property Map

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authorization Property Map

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl String

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId String

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret String

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired Boolean

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description String

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled Boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig Map<String>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed Boolean

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import Boolean

loginTheme String

The client login theme. This will override the default theme for the realm.

name String

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

rootUrl String

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens Boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

validPostLogoutRedirectUris List<String>

A list of valid URIs a browser is permitted to redirect to after a successful logout.

validRedirectUris List<String>

webOrigins List<String>

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

Outputs

All input properties are implicitly available as output properties. Additionally, the Client resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.
ResourceServerId string: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
ServiceAccountUserId string: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

Id string: The provider-assigned unique ID for this managed resource.
ResourceServerId string: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
ServiceAccountUserId string: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

id String: The provider-assigned unique ID for this managed resource.
resourceServerId String: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
serviceAccountUserId String: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

id string: The provider-assigned unique ID for this managed resource.
resourceServerId string: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
serviceAccountUserId string: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

id str: The provider-assigned unique ID for this managed resource.
resource_server_id str: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
service_account_user_id str: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

id String: The provider-assigned unique ID for this managed resource.
resourceServerId String: (Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).
serviceAccountUserId String: (Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

Look up Existing Client Resource

Get an existing Client resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: ClientState, opts?: CustomResourceOptions): Client

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_token_lifespan: Optional[str] = None,
        access_type: Optional[str] = None,
        admin_url: Optional[str] = None,
        always_display_in_console: Optional[bool] = None,
        authentication_flow_binding_overrides: Optional[ClientAuthenticationFlowBindingOverridesArgs] = None,
        authorization: Optional[ClientAuthorizationArgs] = None,
        backchannel_logout_revoke_offline_sessions: Optional[bool] = None,
        backchannel_logout_session_required: Optional[bool] = None,
        backchannel_logout_url: Optional[str] = None,
        base_url: Optional[str] = None,
        client_authenticator_type: Optional[str] = None,
        client_id: Optional[str] = None,
        client_offline_session_idle_timeout: Optional[str] = None,
        client_offline_session_max_lifespan: Optional[str] = None,
        client_secret: Optional[str] = None,
        client_session_idle_timeout: Optional[str] = None,
        client_session_max_lifespan: Optional[str] = None,
        consent_required: Optional[bool] = None,
        consent_screen_text: Optional[str] = None,
        description: Optional[str] = None,
        direct_access_grants_enabled: Optional[bool] = None,
        display_on_consent_screen: Optional[bool] = None,
        enabled: Optional[bool] = None,
        exclude_issuer_from_auth_response: Optional[bool] = None,
        exclude_session_state_from_auth_response: Optional[bool] = None,
        extra_config: Optional[Mapping[str, str]] = None,
        frontchannel_logout_enabled: Optional[bool] = None,
        frontchannel_logout_url: Optional[str] = None,
        full_scope_allowed: Optional[bool] = None,
        implicit_flow_enabled: Optional[bool] = None,
        import_: Optional[bool] = None,
        login_theme: Optional[str] = None,
        name: Optional[str] = None,
        oauth2_device_authorization_grant_enabled: Optional[bool] = None,
        oauth2_device_code_lifespan: Optional[str] = None,
        oauth2_device_polling_interval: Optional[str] = None,
        pkce_code_challenge_method: Optional[str] = None,
        realm_id: Optional[str] = None,
        resource_server_id: Optional[str] = None,
        root_url: Optional[str] = None,
        service_account_user_id: Optional[str] = None,
        service_accounts_enabled: Optional[bool] = None,
        standard_flow_enabled: Optional[bool] = None,
        use_refresh_tokens: Optional[bool] = None,
        use_refresh_tokens_client_credentials: Optional[bool] = None,
        valid_post_logout_redirect_uris: Optional[Sequence[str]] = None,
        valid_redirect_uris: Optional[Sequence[str]] = None,
        web_origins: Optional[Sequence[str]] = None) -> Client

func GetClient(ctx *Context, name string, id IDInput, state *ClientState, opts ...ResourceOption) (*Client, error)

public static Client Get(string name, Input<string> id, ClientState? state, CustomResourceOptions? opts = null)

public static Client get(String name, Output<String> id, ClientState state, CustomResourceOptions options)

resources:  _:    type: keycloak:openid:Client    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

The amount of time in seconds before an access token expires. This will override the default for the realm.

AccessType string

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

AdminUrl string

URL to the admin interface of the client.

AuthenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

Authorization ClientAuthorization

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

BaseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

ClientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

ClientSecret string

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

Description string

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

Enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

ExtraConfig Dictionary<string, string>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

Import bool

LoginTheme string

The client login theme. This will override the default theme for the realm.

Name string

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

RealmId string

The realm this client is attached to.

ResourceServerId string

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

RootUrl string

ServiceAccountUserId string

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

ValidPostLogoutRedirectUris List<string>

A list of valid URIs a browser is permitted to redirect to after a successful logout.

ValidRedirectUris List<string>

WebOrigins List<string>

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

The amount of time in seconds before an access token expires. This will override the default for the realm.

AccessType string

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

AdminUrl string

URL to the admin interface of the client.

AuthenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverridesArgs

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

Authorization ClientAuthorizationArgs

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

BaseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

ClientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

ClientSecret string

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

Description string

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

Enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

ExtraConfig map[string]string

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

Import bool

LoginTheme string

The client login theme. This will override the default theme for the realm.

Name string

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

RealmId string

The realm this client is attached to.

ResourceServerId string

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

RootUrl string

ServiceAccountUserId string

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

ValidPostLogoutRedirectUris []string

A list of valid URIs a browser is permitted to redirect to after a successful logout.

ValidRedirectUris []string

WebOrigins []string

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

The amount of time in seconds before an access token expires. This will override the default for the realm.

accessType String

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

adminUrl String

URL to the admin interface of the client.

authenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl String

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId String

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret String

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired Boolean

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description String

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled Boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig Map<String,String>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed Boolean

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import_ Boolean

loginTheme String

The client login theme. This will override the default theme for the realm.

name String

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

realmId String

The realm this client is attached to.

resourceServerId String

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

rootUrl String

serviceAccountUserId String

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens Boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

authenticationFlowBindingOverrides ClientAuthenticationFlowBindingOverrides

validPostLogoutRedirectUris List<String>

A list of valid URIs a browser is permitted to redirect to after a successful logout.

validRedirectUris List<String>

webOrigins List<String>

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

accessTokenLifespan string

The amount of time in seconds before an access token expires. This will override the default for the realm.

accessType string

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

adminUrl string

URL to the admin interface of the client.

alwaysDisplayInConsole boolean

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authentication_flow_binding_overrides ClientAuthenticationFlowBindingOverridesArgs

backchannelLogoutRevokeOfflineSessions boolean

backchannelLogoutSessionRequired boolean

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

backchannelLogoutUrl string

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl string

Default URL to use when the auth server needs to redirect or link back to the client.

clientAuthenticatorType string

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId string

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

clientOfflineSessionIdleTimeout string

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

clientOfflineSessionMaxLifespan string

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret string

clientSessionIdleTimeout string

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

clientSessionMaxLifespan string

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired boolean

When true, users have to consent to client access. Defaults to false.

consentScreenText string

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description string

The description of this client in the GUI.

directAccessGrantsEnabled boolean

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

displayOnConsentScreen boolean

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

excludeIssuerFromAuthResponse boolean

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

excludeSessionStateFromAuthResponse boolean

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig {[key: string]: string}

frontchannelLogoutEnabled boolean

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

frontchannelLogoutUrl string

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed boolean

Allow to include all roles mappings in the access token.

implicitFlowEnabled boolean

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import boolean

loginTheme string

The client login theme. This will override the default theme for the realm.

name string

The display name of this client in the GUI.

oauth2DeviceAuthorizationGrantEnabled boolean

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

oauth2DeviceCodeLifespan string

The maximum amount of time a client has to finish the device code flow before it expires.

oauth2DevicePollingInterval string

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

pkceCodeChallengeMethod string

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

realmId string

The realm this client is attached to.

resourceServerId string

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

rootUrl string

serviceAccountUserId string

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

serviceAccountsEnabled boolean

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

standardFlowEnabled boolean

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

useRefreshTokensClientCredentials boolean

validPostLogoutRedirectUris string[]

A list of valid URIs a browser is permitted to redirect to after a successful logout.

validRedirectUris string[]

webOrigins string[]

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

access_token_lifespan str

The amount of time in seconds before an access token expires. This will override the default for the realm.

access_type str

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

admin_url str

URL to the admin interface of the client.

always_display_in_console bool

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authorization ClientAuthorizationArgs

backchannel_logout_revoke_offline_sessions bool

backchannel_logout_session_required bool

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

backchannel_logout_url str

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

base_url str

Default URL to use when the auth server needs to redirect or link back to the client.

client_authenticator_type str

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

client_id str

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

client_offline_session_idle_timeout str

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

client_offline_session_max_lifespan str

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

client_secret str

client_session_idle_timeout str

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

client_session_max_lifespan str

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consent_required bool

When true, users have to consent to client access. Defaults to false.

consent_screen_text str

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description str

The description of this client in the GUI.

direct_access_grants_enabled bool

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

display_on_consent_screen bool

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled bool

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

exclude_issuer_from_auth_response bool

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

exclude_session_state_from_auth_response bool

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extra_config Mapping[str, str]

frontchannel_logout_enabled bool

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

frontchannel_logout_url str

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

full_scope_allowed bool

Allow to include all roles mappings in the access token.

implicit_flow_enabled bool

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import_ bool

login_theme str

The client login theme. This will override the default theme for the realm.

name str

The display name of this client in the GUI.

oauth2_device_authorization_grant_enabled bool

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

oauth2_device_code_lifespan str

The maximum amount of time a client has to finish the device code flow before it expires.

oauth2_device_polling_interval str

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

pkce_code_challenge_method str

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

realm_id str

The realm this client is attached to.

resource_server_id str

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

root_url str

service_account_user_id str

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

service_accounts_enabled bool

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

standard_flow_enabled bool

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

use_refresh_tokens bool

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.

use_refresh_tokens_client_credentials bool

valid_post_logout_redirect_uris Sequence[str]

A list of valid URIs a browser is permitted to redirect to after a successful logout.

valid_redirect_uris Sequence[str]

web_origins Sequence[str]

A list of allowed CORS origins. To permit all valid redirect URIs, add +. Note that this will not include the * wildcard. To permit all origins, explicitly add *.

The amount of time in seconds before an access token expires. This will override the default for the realm.

accessType String

Specifies the type of client, which can be one of the following:

CONFIDENTIAL - Used for server-side clients that require both client ID and secret when authenticating. This client should be used for applications using the Authorization Code or Client Credentials grant flows.
PUBLIC - Used for browser-only applications that do not require a client secret, and instead rely only on authorized redirect URIs for security. This client should be used for applications using the Implicit grant flow.
BEARER-ONLY - Used for services that never initiate a login. This client will only allow bearer token requests.

adminUrl String

URL to the admin interface of the client.

authenticationFlowBindingOverrides Property Map

Always list this client in the Account UI, even if the user does not have an active session.

Override realm authentication flow bindings

authorization Property Map

When true, a sid (session ID) claim will be included in the logout token when the backchannel logout URL is used. Defaults to true.

The URL that will cause the client to log itself out when a logout request is sent to this realm. If omitted, no logout request will be sent to the client is this case.

baseUrl String

Default URL to use when the auth server needs to redirect or link back to the client.

Defaults to client-secret. The authenticator type for clients with an access_type of CONFIDENTIAL or BEARER-ONLY. A default Keycloak installation will have the following available types:

client-secret (Default) Use client id and client secret to authenticate client.
client-jwt Use signed JWT to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>
client-x509 Use x509 certificate to authenticate client. Set Subject DN in extra_config with attributes.x509.subjectdn = <subjectDn>
client-secret-jwt Use signed JWT with client secret to authenticate client. Set signing algorithm in extra_config with attributes.token.endpoint.auth.signing.alg = <alg>

clientId String

The Client ID for this client, referenced in the URI during authentication and in issued tokens.

Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. If not set it uses the standard SSO Session Idle value.

Max time before a client session is expired. Tokens are invalidated when a client session is expired. If not set, it uses the standard SSO Session Max value.

clientSecret String

Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. If not set it uses the Offline Session Idle value.

Max time before a client offline session is expired. Offline tokens are invalidated when a client offline session is expired. If not set, it uses the Offline Session Max value.

consentRequired Boolean

When true, users have to consent to client access. Defaults to false.

The text to display on the consent screen about permissions specific to this client. This is applicable only when display_on_consent_screen is true.

description String

The description of this client in the GUI.

When true, the OAuth2 Resource Owner Password Grant will be enabled for this client. Defaults to false.

When true, the consent screen will display information about the client itself. Defaults to false. This is applicable only when consent_required is true.

enabled Boolean

When false, this client will not be able to initiate a login or obtain access tokens. Defaults to true.

When true, the parameter iss will not be included in OpenID Connect Authentication Response.

When true, the parameter session_state will not be included in OpenID Connect Authentication Response.

extraConfig Map<String>

When true, frontchannel logout will be enabled for this client. Specify the url with frontchannel_logout_url. Defaults to false.

The frontchannel logout url. This is applicable only when frontchannel_logout_enabled is true.

fullScopeAllowed Boolean

Allow to include all roles mappings in the access token.

When true, the OAuth2 Implicit Grant will be enabled for this client. Defaults to false.

import Boolean

loginTheme String

The client login theme. This will override the default theme for the realm.

name String

The display name of this client in the GUI.

Enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.

The maximum amount of time a client has to finish the device code flow before it expires.

The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.

The challenge method to use for Proof Key for Code Exchange. Can be either plain or S256 or set to empty value ``.

realmId String

The realm this client is attached to.

resourceServerId String

(Computed) When authorization is enabled for this client, this attribute is the unique ID for the client (the same value as the .id attribute).

rootUrl String

serviceAccountUserId String

(Computed) When service accounts are enabled for this client, this attribute is the unique ID for the Keycloak user that represents this service account.

When true, the OAuth2 Client Credentials grant will be enabled for this client. Defaults to false.

When true, the OAuth2 Authorization Code Grant will be enabled for this client. Defaults to false.

useRefreshTokens Boolean

If this is true, a refresh_token will be created and added to the token response. If this is false then no refresh_token will be generated. Defaults to true.