1. Packages
  2. Keycloak Provider
  3. API Docs
  4. openid
  5. ClientAuthorizationScope
Keycloak v6.9.0 published on Wednesday, Dec 24, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.openid.ClientAuthorizationScope

keycloak logo
Keycloak v6.9.0 published on Wednesday, Dec 24, 2025 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows you to manage openid Client Authorization Scopes.

    Authorization scopes represent the actions that can be performed on resources. They are used in permissions to define what operations are allowed.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
});
const test = new keycloak.openid.Client("test", {
    clientId: "client_id",
    realmId: realm.id,
    accessType: "CONFIDENTIAL",
    serviceAccountsEnabled: true,
    authorization: {
        policyEnforcementMode: "ENFORCING",
    },
});
const read = new keycloak.openid.ClientAuthorizationScope("read", {
    resourceServerId: test.resourceServerId,
    realmId: realm.id,
    name: "read",
    displayName: "Read Access",
    iconUri: "https://example.com/icons/read.png",
});
const write = new keycloak.openid.ClientAuthorizationScope("write", {
    resourceServerId: test.resourceServerId,
    realmId: realm.id,
    name: "write",
    displayName: "Write Access",
});
const _delete = new keycloak.openid.ClientAuthorizationScope("delete", {
    resourceServerId: test.resourceServerId,
    realmId: realm.id,
    name: "delete",
    displayName: "Delete Access",
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True)
test = keycloak.openid.Client("test",
    client_id="client_id",
    realm_id=realm.id,
    access_type="CONFIDENTIAL",
    service_accounts_enabled=True,
    authorization={
        "policy_enforcement_mode": "ENFORCING",
    })
read = keycloak.openid.ClientAuthorizationScope("read",
    resource_server_id=test.resource_server_id,
    realm_id=realm.id,
    name="read",
    display_name="Read Access",
    icon_uri="https://example.com/icons/read.png")
write = keycloak.openid.ClientAuthorizationScope("write",
    resource_server_id=test.resource_server_id,
    realm_id=realm.id,
    name="write",
    display_name="Write Access")
delete = keycloak.openid.ClientAuthorizationScope("delete",
    resource_server_id=test.resource_server_id,
    realm_id=realm.id,
    name="delete",
    display_name="Delete Access")

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak/openid"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:   pulumi.String("my-realm"),
			Enabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		test, err := openid.NewClient(ctx, "test", &openid.ClientArgs{
			ClientId:               pulumi.String("client_id"),
			RealmId:                realm.ID(),
			AccessType:             pulumi.String("CONFIDENTIAL"),
			ServiceAccountsEnabled: pulumi.Bool(true),
			Authorization: &openid.ClientAuthorizationArgs{
				PolicyEnforcementMode: pulumi.String("ENFORCING"),
			},
		})
		if err != nil {
			return err
		}
		_, err = openid.NewClientAuthorizationScope(ctx, "read", &openid.ClientAuthorizationScopeArgs{
			ResourceServerId: test.ResourceServerId,
			RealmId:          realm.ID(),
			Name:             pulumi.String("read"),
			DisplayName:      pulumi.String("Read Access"),
			IconUri:          pulumi.String("https://example.com/icons/read.png"),
		})
		if err != nil {
			return err
		}
		_, err = openid.NewClientAuthorizationScope(ctx, "write", &openid.ClientAuthorizationScopeArgs{
			ResourceServerId: test.ResourceServerId,
			RealmId:          realm.ID(),
			Name:             pulumi.String("write"),
			DisplayName:      pulumi.String("Write Access"),
		})
		if err != nil {
			return err
		}
		_, err = openid.NewClientAuthorizationScope(ctx, "delete", &openid.ClientAuthorizationScopeArgs{
			ResourceServerId: test.ResourceServerId,
			RealmId:          realm.ID(),
			Name:             pulumi.String("delete"),
			DisplayName:      pulumi.String("Delete Access"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
    });

    var test = new Keycloak.OpenId.Client("test", new()
    {
        ClientId = "client_id",
        RealmId = realm.Id,
        AccessType = "CONFIDENTIAL",
        ServiceAccountsEnabled = true,
        Authorization = new Keycloak.OpenId.Inputs.ClientAuthorizationArgs
        {
            PolicyEnforcementMode = "ENFORCING",
        },
    });

    var read = new Keycloak.OpenId.ClientAuthorizationScope("read", new()
    {
        ResourceServerId = test.ResourceServerId,
        RealmId = realm.Id,
        Name = "read",
        DisplayName = "Read Access",
        IconUri = "https://example.com/icons/read.png",
    });

    var write = new Keycloak.OpenId.ClientAuthorizationScope("write", new()
    {
        ResourceServerId = test.ResourceServerId,
        RealmId = realm.Id,
        Name = "write",
        DisplayName = "Write Access",
    });

    var delete = new Keycloak.OpenId.ClientAuthorizationScope("delete", new()
    {
        ResourceServerId = test.ResourceServerId,
        RealmId = realm.Id,
        Name = "delete",
        DisplayName = "Delete Access",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.openid.Client;
import com.pulumi.keycloak.openid.ClientArgs;
import com.pulumi.keycloak.openid.inputs.ClientAuthorizationArgs;
import com.pulumi.keycloak.openid.ClientAuthorizationScope;
import com.pulumi.keycloak.openid.ClientAuthorizationScopeArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .build());

        var test = new Client("test", ClientArgs.builder()
            .clientId("client_id")
            .realmId(realm.id())
            .accessType("CONFIDENTIAL")
            .serviceAccountsEnabled(true)
            .authorization(ClientAuthorizationArgs.builder()
                .policyEnforcementMode("ENFORCING")
                .build())
            .build());

        var read = new ClientAuthorizationScope("read", ClientAuthorizationScopeArgs.builder()
            .resourceServerId(test.resourceServerId())
            .realmId(realm.id())
            .name("read")
            .displayName("Read Access")
            .iconUri("https://example.com/icons/read.png")
            .build());

        var write = new ClientAuthorizationScope("write", ClientAuthorizationScopeArgs.builder()
            .resourceServerId(test.resourceServerId())
            .realmId(realm.id())
            .name("write")
            .displayName("Write Access")
            .build());

        var delete = new ClientAuthorizationScope("delete", ClientAuthorizationScopeArgs.builder()
            .resourceServerId(test.resourceServerId())
            .realmId(realm.id())
            .name("delete")
            .displayName("Delete Access")
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
  test:
    type: keycloak:openid:Client
    properties:
      clientId: client_id
      realmId: ${realm.id}
      accessType: CONFIDENTIAL
      serviceAccountsEnabled: true
      authorization:
        policyEnforcementMode: ENFORCING
  read:
    type: keycloak:openid:ClientAuthorizationScope
    properties:
      resourceServerId: ${test.resourceServerId}
      realmId: ${realm.id}
      name: read
      displayName: Read Access
      iconUri: https://example.com/icons/read.png
  write:
    type: keycloak:openid:ClientAuthorizationScope
    properties:
      resourceServerId: ${test.resourceServerId}
      realmId: ${realm.id}
      name: write
      displayName: Write Access
  delete:
    type: keycloak:openid:ClientAuthorizationScope
    properties:
      resourceServerId: ${test.resourceServerId}
      realmId: ${realm.id}
      name: delete
      displayName: Delete Access

    Argument Reference

    The following arguments are supported:

    • realm_id - (Required) The realm this scope exists in.
    • resource_server_id - (Required) The ID of the resource server.
    • name - (Required) The name of the scope.
    • display_name - (Optional) The display name of the scope.
    • icon_uri - (Optional) An icon URI for the scope.

    Attributes Reference

    In addition to the arguments listed above, the following computed attributes are exported:

    • id - Scope ID representing the authorization scope.

    Create ClientAuthorizationScope Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new ClientAuthorizationScope(name: string, args: ClientAuthorizationScopeArgs, opts?: CustomResourceOptions);
    @overload
def ClientAuthorizationScope(resource_name: str,
                             args: ClientAuthorizationScopeArgs,
                             opts: Optional[ResourceOptions] = None)

@overload
def ClientAuthorizationScope(resource_name: str,
                             opts: Optional[ResourceOptions] = None,
                             realm_id: Optional[str] = None,
                             resource_server_id: Optional[str] = None,
                             display_name: Optional[str] = None,
                             icon_uri: Optional[str] = None,
                             name: Optional[str] = None)
    func NewClientAuthorizationScope(ctx *Context, name string, args ClientAuthorizationScopeArgs, opts ...ResourceOption) (*ClientAuthorizationScope, error)
    public ClientAuthorizationScope(string name, ClientAuthorizationScopeArgs args, CustomResourceOptions? opts = null)
    public ClientAuthorizationScope(String name, ClientAuthorizationScopeArgs args)
public ClientAuthorizationScope(String name, ClientAuthorizationScopeArgs args, CustomResourceOptions options)

    type: keycloak:openid:ClientAuthorizationScope
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args ClientAuthorizationScopeArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args ClientAuthorizationScopeArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args ClientAuthorizationScopeArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args ClientAuthorizationScopeArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args ClientAuthorizationScopeArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var clientAuthorizationScopeResource = new Keycloak.OpenId.ClientAuthorizationScope("clientAuthorizationScopeResource", new()
{
    RealmId = "string",
    ResourceServerId = "string",
    DisplayName = "string",
    IconUri = "string",
    Name = "string",
});

    example, err := openid.NewClientAuthorizationScope(ctx, "clientAuthorizationScopeResource", &openid.ClientAuthorizationScopeArgs{
	RealmId:          pulumi.String("string"),
	ResourceServerId: pulumi.String("string"),
	DisplayName:      pulumi.String("string"),
	IconUri:          pulumi.String("string"),
	Name:             pulumi.String("string"),
})

    var clientAuthorizationScopeResource = new ClientAuthorizationScope("clientAuthorizationScopeResource", ClientAuthorizationScopeArgs.builder()
    .realmId("string")
    .resourceServerId("string")
    .displayName("string")
    .iconUri("string")
    .name("string")
    .build());

    client_authorization_scope_resource = keycloak.openid.ClientAuthorizationScope("clientAuthorizationScopeResource",
    realm_id="string",
    resource_server_id="string",
    display_name="string",
    icon_uri="string",
    name="string")

    const clientAuthorizationScopeResource = new keycloak.openid.ClientAuthorizationScope("clientAuthorizationScopeResource", {
    realmId: "string",
    resourceServerId: "string",
    displayName: "string",
    iconUri: "string",
    name: "string",
});

    type: keycloak:openid:ClientAuthorizationScope
properties:
    displayName: string
    iconUri: string
    name: string
    realmId: string
    resourceServerId: string

    ClientAuthorizationScope Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The ClientAuthorizationScope resource accepts the following input properties:

    RealmId string
    ResourceServerId string
    DisplayName string
    IconUri string
    Name string
    RealmId string
    ResourceServerId string
    DisplayName string
    IconUri string
    Name string
    realmId String
    resourceServerId String
    displayName String
    iconUri String
    name String
    realmId string
    resourceServerId string
    displayName string
    iconUri string
    name string
    realmId String
    resourceServerId String
    displayName String
    iconUri String
    name String

    Outputs

    All input properties are implicitly available as output properties. Additionally, the ClientAuthorizationScope resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing ClientAuthorizationScope Resource

    Get an existing ClientAuthorizationScope resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: ClientAuthorizationScopeState, opts?: CustomResourceOptions): ClientAuthorizationScope
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        display_name: Optional[str] = None,
        icon_uri: Optional[str] = None,
        name: Optional[str] = None,
        realm_id: Optional[str] = None,
        resource_server_id: Optional[str] = None) -> ClientAuthorizationScope
    func GetClientAuthorizationScope(ctx *Context, name string, id IDInput, state *ClientAuthorizationScopeState, opts ...ResourceOption) (*ClientAuthorizationScope, error)
    public static ClientAuthorizationScope Get(string name, Input<string> id, ClientAuthorizationScopeState? state, CustomResourceOptions? opts = null)
    public static ClientAuthorizationScope get(String name, Output<String> id, ClientAuthorizationScopeState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:openid:ClientAuthorizationScope    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    DisplayName string
    IconUri string
    Name string
    RealmId string
    ResourceServerId string
    DisplayName string
    IconUri string
    Name string
    RealmId string
    ResourceServerId string
    displayName String
    iconUri String
    name String
    realmId String
    resourceServerId String
    displayName string
    iconUri string
    name string
    realmId string
    resourceServerId string
    displayName String
    iconUri String
    name String
    realmId String
    resourceServerId String

    Import

    Client authorization scopes can be imported using the format: {{realmId}}/{{resourceServerId}}/{{authorizationScopeId}}.

    Example:

    bash

    $ pulumi import keycloak:openid/clientAuthorizationScope:ClientAuthorizationScope test my-realm/3bd4a686-1062-4b59-97b8-e4e3f10b99da/63b3cde8-987d-4cd9-9306-1955579281d9

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo
    Keycloak v6.9.0 published on Wednesday, Dec 24, 2025 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak
      Meet Neo: Your AI Platform Teammate