Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. Keycloak Provider
  4. API Docs
  5. RealmClientRegistrationPolicy
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

keycloak.RealmClientRegistrationPolicy

keycloak logo keycloak logo
Viewing docs for Keycloak v6.13.0
published on Saturday, Aug 1, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-keycloak

    Allows for managing Realm Client Registration Policies.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {realm: "my-realm"});
const custom = new keycloak.RealmClientRegistrationPolicy("custom", {
    realmId: realm.id,
    name: "My Custom Policy",
    providerId: "my-client-registration-policy",
    subType: "anonymous",
});
// A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
const trustedHosts = new keycloak.RealmClientRegistrationPolicy("trusted_hosts", {
    realmId: realm.id,
    name: "Trusted Hosts",
    providerId: "trusted-hosts",
    subType: "anonymous",
    config: {
        "host-sending-registration-request-must-match": "true",
        "client-uris-must-match": "true",
        "trusted-hosts": "localhost,auth.example.com",
    },
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm", realm="my-realm")
custom = keycloak.RealmClientRegistrationPolicy("custom",
    realm_id=realm.id,
    name="My Custom Policy",
    provider_id="my-client-registration-policy",
    sub_type="anonymous")
# A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
trusted_hosts = keycloak.RealmClientRegistrationPolicy("trusted_hosts",
    realm_id=realm.id,
    name="Trusted Hosts",
    provider_id="trusted-hosts",
    sub_type="anonymous",
    config={
        "host-sending-registration-request-must-match": "true",
        "client-uris-must-match": "true",
        "trusted-hosts": "localhost,auth.example.com",
    })

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		realm, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm: pulumi.String("my-realm"),
		})
		if err != nil {
			return err
		}
		_, err = keycloak.NewRealmClientRegistrationPolicy(ctx, "custom", &keycloak.RealmClientRegistrationPolicyArgs{
			RealmId:    realm.ID(),
			Name:       pulumi.String("My Custom Policy"),
			ProviderId: pulumi.String("my-client-registration-policy"),
			SubType:    pulumi.String("anonymous"),
		})
		if err != nil {
			return err
		}
		// A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
		_, err = keycloak.NewRealmClientRegistrationPolicy(ctx, "trusted_hosts", &keycloak.RealmClientRegistrationPolicyArgs{
			RealmId:    realm.ID(),
			Name:       pulumi.String("Trusted Hosts"),
			ProviderId: pulumi.String("trusted-hosts"),
			SubType:    pulumi.String("anonymous"),
			Config: pulumi.StringMap{
				"host-sending-registration-request-must-match": pulumi.String("true"),
				"client-uris-must-match":                       pulumi.String("true"),
				"trusted-hosts":                                pulumi.String("localhost,auth.example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
    });

    var custom = new Keycloak.RealmClientRegistrationPolicy("custom", new()
    {
        RealmId = realm.Id,
        Name = "My Custom Policy",
        ProviderId = "my-client-registration-policy",
        SubType = "anonymous",
    });

    // A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
    var trustedHosts = new Keycloak.RealmClientRegistrationPolicy("trusted_hosts", new()
    {
        RealmId = realm.Id,
        Name = "Trusted Hosts",
        ProviderId = "trusted-hosts",
        SubType = "anonymous",
        Config = 
        {
            { "host-sending-registration-request-must-match", "true" },
            { "client-uris-must-match", "true" },
            { "trusted-hosts", "localhost,auth.example.com" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.RealmClientRegistrationPolicy;
import com.pulumi.keycloak.RealmClientRegistrationPolicyArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .build());

        var custom = new RealmClientRegistrationPolicy("custom", RealmClientRegistrationPolicyArgs.builder()
            .realmId(realm.id())
            .name("My Custom Policy")
            .providerId("my-client-registration-policy")
            .subType("anonymous")
            .build());

        // A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
        var trustedHosts = new RealmClientRegistrationPolicy("trustedHosts", RealmClientRegistrationPolicyArgs.builder()
            .realmId(realm.id())
            .name("Trusted Hosts")
            .providerId("trusted-hosts")
            .subType("anonymous")
            .config(Map.ofEntries(
                Map.entry("host-sending-registration-request-must-match", "true"),
                Map.entry("client-uris-must-match", "true"),
                Map.entry("trusted-hosts", "localhost,auth.example.com")
            ))
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
  custom:
    type: keycloak:RealmClientRegistrationPolicy
    properties:
      realmId: ${realm.id}
      name: My Custom Policy
      providerId: my-client-registration-policy
      subType: anonymous
  # A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
  trustedHosts:
    type: keycloak:RealmClientRegistrationPolicy
    name: trusted_hosts
    properties:
      realmId: ${realm.id}
      name: Trusted Hosts
      providerId: trusted-hosts
      subType: anonymous
      config:
        host-sending-registration-request-must-match: 'true'
        client-uris-must-match: 'true'
        trusted-hosts: localhost,auth.example.com

    pulumi {
  required_providers {
    keycloak = {
      source = "pulumi/keycloak"
    }
  }
}

resource "keycloak_realm" "realm" {
  realm = "my-realm"
}
resource "keycloak_realmclientregistrationpolicy" "custom" {
  realm_id    = keycloak_realm.realm.id
  name        = "My Custom Policy"
  provider_id = "my-client-registration-policy"
  sub_type    = "anonymous"
}
# A built-in policy with multi-value config (trusted-hosts is an array in Keycloak)
resource "keycloak_realmclientregistrationpolicy" "trusted_hosts" {
  realm_id    = keycloak_realm.realm.id
  name        = "Trusted Hosts"
  provider_id = "trusted-hosts"
  sub_type    = "anonymous"
  config = {
    "host-sending-registration-request-must-match" = "true"
    "client-uris-must-match"                       = "true"
    "trusted-hosts"                                = "localhost,auth.example.com"
  }
}

    Attribute Arguments

    • name - (Required) Display name of the policy.
    • realmId - (Required) The realm this policy exists in.
    • providerId - (Required) The ID of the policy provider (e.g. trusted-hosts, max-clients). The referenced provider must already be registered in Keycloak.
    • subType - (Required) Whether this policy applies to anonymous or authenticated client registration.
    • config - (Optional) A map of provider-specific configuration values.

    Multi-value configuration

    Some policy config fields store a list of values rather than a single value (for the built-in policies these are trusted-hosts, allowed-client-scopes and allowed-protocol-mapper-types). Supply these as a single comma-separated string, e.g. "trusted-hosts" = "localhost,auth.example.com". The provider splits the value into the array Keycloak expects on write and re-joins it on read. Because Keycloak does not preserve element order, a pure reorder of these values is treated as a no-op and does not produce a perpetual diff.

    Which fields are multi-valued is detected automatically from Keycloak’s policy provider metadata (properties reported with a type of MultivaluedString or MultivaluedList), so this works for any provider — including custom SPI policies — without a hardcoded list.

    Create RealmClientRegistrationPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RealmClientRegistrationPolicy(name: string, args: RealmClientRegistrationPolicyArgs, opts?: CustomResourceOptions);
    @overload
def RealmClientRegistrationPolicy(resource_name: str,
                                  args: RealmClientRegistrationPolicyArgs,
                                  opts: Optional[ResourceOptions] = None)

@overload
def RealmClientRegistrationPolicy(resource_name: str,
                                  opts: Optional[ResourceOptions] = None,
                                  provider_id: Optional[str] = None,
                                  realm_id: Optional[str] = None,
                                  sub_type: Optional[str] = None,
                                  config: Optional[Mapping[str, str]] = None,
                                  name: Optional[str] = None)
    func NewRealmClientRegistrationPolicy(ctx *Context, name string, args RealmClientRegistrationPolicyArgs, opts ...ResourceOption) (*RealmClientRegistrationPolicy, error)
    public RealmClientRegistrationPolicy(string name, RealmClientRegistrationPolicyArgs args, CustomResourceOptions? opts = null)
    public RealmClientRegistrationPolicy(String name, RealmClientRegistrationPolicyArgs args)
public RealmClientRegistrationPolicy(String name, RealmClientRegistrationPolicyArgs args, CustomResourceOptions options)

    type: keycloak:RealmClientRegistrationPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "keycloak_realm_client_registration_policy" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args RealmClientRegistrationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RealmClientRegistrationPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RealmClientRegistrationPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RealmClientRegistrationPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RealmClientRegistrationPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var realmClientRegistrationPolicyResource = new Keycloak.RealmClientRegistrationPolicy("realmClientRegistrationPolicyResource", new()
{
    ProviderId = "string",
    RealmId = "string",
    SubType = "string",
    Config = 
    {
        { "string", "string" },
    },
    Name = "string",
});

    example, err := keycloak.NewRealmClientRegistrationPolicy(ctx, "realmClientRegistrationPolicyResource", &keycloak.RealmClientRegistrationPolicyArgs{
	ProviderId: pulumi.String("string"),
	RealmId:    pulumi.String("string"),
	SubType:    pulumi.String("string"),
	Config: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	Name: pulumi.String("string"),
})

    resource "keycloak_realm_client_registration_policy" "realmClientRegistrationPolicyResource" {
  lifecycle {
    create_before_destroy = true
  }
  provider_id = "string"
  realm_id    = "string"
  sub_type    = "string"
  config = {
    "string" = "string"
  }
  name = "string"
}

    var realmClientRegistrationPolicyResource = new RealmClientRegistrationPolicy("realmClientRegistrationPolicyResource", RealmClientRegistrationPolicyArgs.builder()
    .providerId("string")
    .realmId("string")
    .subType("string")
    .config(Map.of("string", "string"))
    .name("string")
    .build());

    realm_client_registration_policy_resource = keycloak.RealmClientRegistrationPolicy("realmClientRegistrationPolicyResource",
    provider_id="string",
    realm_id="string",
    sub_type="string",
    config={
        "string": "string",
    },
    name="string")

    const realmClientRegistrationPolicyResource = new keycloak.RealmClientRegistrationPolicy("realmClientRegistrationPolicyResource", {
    providerId: "string",
    realmId: "string",
    subType: "string",
    config: {
        string: "string",
    },
    name: "string",
});

    type: keycloak:RealmClientRegistrationPolicy
properties:
    config:
        string: string
    name: string
    providerId: string
    realmId: string
    subType: string

    RealmClientRegistrationPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The RealmClientRegistrationPolicy resource accepts the following input properties:

    ProviderId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    RealmId string
    SubType string
    Whether this policy applies to anonymous or authenticated client registration.
    Config Dictionary<string, string>
    Policy-specific configuration key-value pairs.
    Name string
    ProviderId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    RealmId string
    SubType string
    Whether this policy applies to anonymous or authenticated client registration.
    Config map[string]string
    Policy-specific configuration key-value pairs.
    Name string
    provider_id string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realm_id string
    sub_type string
    Whether this policy applies to anonymous or authenticated client registration.
    config map(string)
    Policy-specific configuration key-value pairs.
    name string
    providerId String
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId String
    subType String
    Whether this policy applies to anonymous or authenticated client registration.
    config Map<String,String>
    Policy-specific configuration key-value pairs.
    name String
    providerId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId string
    subType string
    Whether this policy applies to anonymous or authenticated client registration.
    config {[key: string]: string}
    Policy-specific configuration key-value pairs.
    name string
    provider_id str
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realm_id str
    sub_type str
    Whether this policy applies to anonymous or authenticated client registration.
    config Mapping[str, str]
    Policy-specific configuration key-value pairs.
    name str
    providerId String
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId String
    subType String
    Whether this policy applies to anonymous or authenticated client registration.
    config Map<String>
    Policy-specific configuration key-value pairs.
    name String

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RealmClientRegistrationPolicy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing RealmClientRegistrationPolicy Resource

    Get an existing RealmClientRegistrationPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RealmClientRegistrationPolicyState, opts?: CustomResourceOptions): RealmClientRegistrationPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        config: Optional[Mapping[str, str]] = None,
        name: Optional[str] = None,
        provider_id: Optional[str] = None,
        realm_id: Optional[str] = None,
        sub_type: Optional[str] = None) -> RealmClientRegistrationPolicy
    func GetRealmClientRegistrationPolicy(ctx *Context, name string, id IDInput, state *RealmClientRegistrationPolicyState, opts ...ResourceOption) (*RealmClientRegistrationPolicy, error)
    public static RealmClientRegistrationPolicy Get(string name, Input<string> id, RealmClientRegistrationPolicyState? state, CustomResourceOptions? opts = null)
    public static RealmClientRegistrationPolicy get(String name, Output<String> id, RealmClientRegistrationPolicyState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:RealmClientRegistrationPolicy    get:      id: ${id}
    import {
  to = keycloak_realm_client_registration_policy.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Config Dictionary<string, string>
    Policy-specific configuration key-value pairs.
    Name string
    ProviderId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    RealmId string
    SubType string
    Whether this policy applies to anonymous or authenticated client registration.
    Config map[string]string
    Policy-specific configuration key-value pairs.
    Name string
    ProviderId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    RealmId string
    SubType string
    Whether this policy applies to anonymous or authenticated client registration.
    config map(string)
    Policy-specific configuration key-value pairs.
    name string
    provider_id string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realm_id string
    sub_type string
    Whether this policy applies to anonymous or authenticated client registration.
    config Map<String,String>
    Policy-specific configuration key-value pairs.
    name String
    providerId String
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId String
    subType String
    Whether this policy applies to anonymous or authenticated client registration.
    config {[key: string]: string}
    Policy-specific configuration key-value pairs.
    name string
    providerId string
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId string
    subType string
    Whether this policy applies to anonymous or authenticated client registration.
    config Mapping[str, str]
    Policy-specific configuration key-value pairs.
    name str
    provider_id str
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realm_id str
    sub_type str
    Whether this policy applies to anonymous or authenticated client registration.
    config Map<String>
    Policy-specific configuration key-value pairs.
    name String
    providerId String
    The provider ID of the client registration policy (e.g. 'trusted-hosts', 'consent-required').
    realmId String
    subType String
    Whether this policy applies to anonymous or authenticated client registration.

    Import

    Client registration policies can be imported using either of the following formats.

    By realm name and policy ID:

    $ pulumi import keycloak:index/realmClientRegistrationPolicy:RealmClientRegistrationPolicy custom my-realm/618cfba7-49aa-4c09-9a19-2f699b576f0b

    By realm name, policy name, provider ID and sub-type ({realmId}/{name}/{providerId}/{subType}). This is useful for taking ownership of the default policies Keycloak auto-creates, whose server-generated UUID is not known ahead of time:

    $ terraform import keycloak_realm_client_registration_policy.trusted_hosts "my-realm/Trusted Hosts/trusted-hosts/anonymous"

    Note: Keycloak automatically creates default policies for every realm (e.g. “Trusted Hosts”, “Max Clients Limit”). These can be managed by importing them first and then removing the resource block to delete them. The keycloak.RealmClientRegistrationPolicy data source can also be used to look one up dynamically.

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo keycloak logo
    Viewing docs for Keycloak v6.13.0
    published on Saturday, Aug 1, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-keycloak

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial