├── keycloak ├── themes │ └── custom │ │ ├── account │ │ ├── theme.properties │ │ └── resources │ │ │ └── public │ │ │ ├── favicon.png │ │ │ ├── layout.css │ │ │ └── logo.svg │ │ └── login │ │ ├── theme.properties │ │ └── resources │ │ ├── img │ │ └── pexels-pixabay-358312.jpg │ │ └── css │ │ └── styles.css ├── scripts │ └── disable-theme-cache.cli └── realms │ ├── default-users.json │ └── realm-export.json ├── readme-images ├── logo_250x60.png ├── keycloak-login.png ├── login-customised.png ├── welcome-screen.png ├── account-customised.png ├── docker-container-list.png └── imported-realm-in-logs.png ├── .gitignore ├── .env ├── LICENSE ├── docker-compose-keycloak.yml └── README.md /keycloak/themes/custom/account/theme.properties: -------------------------------------------------------------------------------- 1 | parent=keycloak.v2 2 | favIcon=/public/favicon.png -------------------------------------------------------------------------------- /keycloak/themes/custom/login/theme.properties: -------------------------------------------------------------------------------- 1 | parent=keycloak 2 | styles=css/login.css css/tile.css css/styles.css -------------------------------------------------------------------------------- /readme-images/logo_250x60.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/logo_250x60.png -------------------------------------------------------------------------------- /readme-images/keycloak-login.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/keycloak-login.png -------------------------------------------------------------------------------- /readme-images/login-customised.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/login-customised.png -------------------------------------------------------------------------------- /readme-images/welcome-screen.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/welcome-screen.png -------------------------------------------------------------------------------- /readme-images/account-customised.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/account-customised.png -------------------------------------------------------------------------------- /readme-images/docker-container-list.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/docker-container-list.png -------------------------------------------------------------------------------- /readme-images/imported-realm-in-logs.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/readme-images/imported-realm-in-logs.png -------------------------------------------------------------------------------- /keycloak/themes/custom/account/resources/public/favicon.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/keycloak/themes/custom/account/resources/public/favicon.png -------------------------------------------------------------------------------- /keycloak/themes/custom/login/resources/img/pexels-pixabay-358312.jpg: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/little-pinecone/keycloak-in-docker/HEAD/keycloak/themes/custom/login/resources/img/pexels-pixabay-358312.jpg -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | ### IntelliJ IDEA ### 2 | .idea 3 | *.iws 4 | *.iml 5 | *.ipr 6 | 7 | ### NetBeans ### 8 | /nbproject/private/ 9 | /nbbuild/ 10 | /dist/ 11 | /nbdist/ 12 | /.nb-gradle/ 13 | build/ 14 | !**/src/main/**/build/ 15 | !**/src/test/**/build/ 16 | 17 | ### VS Code ### 18 | .vscode/ 19 | -------------------------------------------------------------------------------- /.env: -------------------------------------------------------------------------------- 1 | COMPOSE_PROJECT_NAME=keycloakindocker 2 | 3 | POSTGRES_VERSION=14.1-alpine 4 | 5 | KEYCLOAK_VERSION=16.1.0 6 | KEYCLOAK_USER=keycloak 7 | KEYCLOAK_PASSWORD=keycloak 8 | 9 | KEYCLOAK_DATABASE_NAME=keycloakdb 10 | KEYCLOAK_DATABASE_USER=keycloakdb 11 | KEYCLOAK_DATABASE_PASSWORD=keycloakdb 12 | KEYCLOAK_DATABASE_HOST=keycloakdb 13 | KEYCLOAK_DATABASE_VENDOR=postgres -------------------------------------------------------------------------------- /keycloak/scripts/disable-theme-cache.cli: -------------------------------------------------------------------------------- 1 | embed-server --std-out=echo --server-config=standalone-ha.xml 2 | /subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheThemes,value=false) 3 | /subsystem=keycloak-server/theme=defaults/:write-attribute(name=cacheTemplates,value=false) 4 | /subsystem=keycloak-server/theme=defaults/:write-attribute(name=staticMaxAge,value=-1) 5 | stop-embedded-server -------------------------------------------------------------------------------- /keycloak/themes/custom/account/resources/public/layout.css: -------------------------------------------------------------------------------- 1 | :root { 2 | --pf-global--primary-color--100: #ff0054; 3 | --pf-global--primary-color--200: #d60248; 4 | --pf-global--primary-color--dark-100: var(--pf-global--primary-color--200); 5 | } 6 | 7 | .pf-c-data-list { 8 | --pf-global--primary-color--100: unset; 9 | } 10 | 11 | .pf-c-button { 12 | --pf-c-button--m-secondary--hover--Color: var(--pf-global--primary-color--200); 13 | --pf-c-button--m-secondary--hover--BorderColor: var(--pf-c-button--m-secondary--hover--Color); 14 | } -------------------------------------------------------------------------------- /keycloak/themes/custom/login/resources/css/styles.css: -------------------------------------------------------------------------------- 1 | :root { 2 | --pf-global--primary-color--100: #ff0054; 3 | --pf-global--primary-color--200: #d60248; 4 | --default-background-color: #97A1CDFF; 5 | --link-hover-color: #02679a; 6 | } 7 | 8 | .login-pf body { 9 | background-image: url('../img/pexels-pixabay-358312.jpg'), 10 | linear-gradient(135deg, var(--default-background-color) 0%, #A96699FF 100%); 11 | } 12 | 13 | .login-pf a:hover { 14 | color: var(--link-hover-color); 15 | text-decoration: none; 16 | } 17 | 18 | .pf-c-form-control { 19 | --pf-global--primary-color--100: unset; 20 | } -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | This is free and unencumbered software released into the public domain. 2 | 3 | Anyone is free to copy, modify, publish, use, compile, sell, or 4 | distribute this software, either in source code form or as a compiled 5 | binary, for any purpose, commercial or non-commercial, and by any 6 | means. 7 | 8 | In jurisdictions that recognize copyright laws, the author or authors 9 | of this software dedicate any and all copyright interest in the 10 | software to the public domain. We make this dedication for the benefit 11 | of the public at large and to the detriment of our heirs and 12 | successors. We intend this dedication to be an overt act of 13 | relinquishment in perpetuity of all present and future rights to this 14 | software under copyright law. 15 | 16 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, 17 | EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 18 | MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. 19 | IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR 20 | OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, 21 | ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR 22 | OTHER DEALINGS IN THE SOFTWARE. 23 | 24 | For more information, please refer to 25 | -------------------------------------------------------------------------------- /docker-compose-keycloak.yml: -------------------------------------------------------------------------------- 1 | version: '3.3' 2 | services: 3 | keycloak: 4 | image: jboss/keycloak:${KEYCLOAK_VERSION} 5 | ports: 6 | - "8024:8080" 7 | environment: 8 | - KEYCLOAK_USER=${KEYCLOAK_USER} 9 | - KEYCLOAK_PASSWORD=${KEYCLOAK_PASSWORD} 10 | - DB_DATABASE=${KEYCLOAK_DATABASE_NAME} 11 | - DB_USER=${KEYCLOAK_DATABASE_USER} 12 | - DB_PASSWORD=${KEYCLOAK_DATABASE_PASSWORD} 13 | - DB_ADDR=${KEYCLOAK_DATABASE_HOST} 14 | - DB_VENDOR=${KEYCLOAK_DATABASE_VENDOR} 15 | - KEYCLOAK_IMPORT=/tmp/realm-export.json 16 | volumes: 17 | - ./keycloak/realms/realm-export.json:/tmp/realm-export.json 18 | - ./keycloak/scripts/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli 19 | - ./keycloak/themes/custom:/opt/jboss/keycloak/themes/custom 20 | networks: 21 | internal: 22 | depends_on: 23 | - keycloakdb 24 | 25 | keycloakdb: 26 | image: postgres:${POSTGRES_VERSION} 27 | ports: 28 | - "5433:5432" 29 | environment: 30 | - POSTGRES_USER=${KEYCLOAK_DATABASE_USER} 31 | - POSTGRES_PASSWORD=${KEYCLOAK_DATABASE_PASSWORD} 32 | - POSTGRES_DB=${KEYCLOAK_DATABASE_NAME} 33 | volumes: 34 | - keycloak-postgres:/var/lib/postgresql/data 35 | networks: 36 | internal: 37 | 38 | volumes: 39 | keycloak-postgres: 40 | 41 | networks: 42 | internal: -------------------------------------------------------------------------------- /keycloak/realms/default-users.json: -------------------------------------------------------------------------------- 1 | { 2 | "users": [ 3 | { 4 | "username": "christina", 5 | "enabled": true, 6 | "email": "christina@test.com", 7 | "firstName": "Christina", 8 | "lastName": "Travis", 9 | "credentials": [ 10 | { 11 | "type": "password", 12 | "value": "test" 13 | } 14 | ], 15 | "realmRoles": [ 16 | "user" 17 | ], 18 | "clientRoles": { 19 | "account": [ 20 | "view-profile", 21 | "manage-account" 22 | ] 23 | } 24 | }, 25 | { 26 | "username": "hanna", 27 | "enabled": true, 28 | "email": "hanna@test.com", 29 | "firstName": "Hanna", 30 | "lastName": "Davis", 31 | "credentials": [ 32 | { 33 | "type": "password", 34 | "value": "test" 35 | } 36 | ], 37 | "realmRoles": [ 38 | "user" 39 | ], 40 | "clientRoles": { 41 | "account": [ 42 | "view-profile", 43 | "manage-account" 44 | ] 45 | } 46 | }, 47 | { 48 | "username": "carlo", 49 | "enabled": true, 50 | "email": "carlo@test.com", 51 | "firstName": "Carlo", 52 | "lastName": "Velazquez", 53 | "credentials": [ 54 | { 55 | "type": "password", 56 | "value": "test" 57 | } 58 | ], 59 | "realmRoles": [ 60 | "user" 61 | ], 62 | "clientRoles": { 63 | "account": [ 64 | "view-profile", 65 | "manage-account" 66 | ] 67 | } 68 | }, 69 | { 70 | "username": "noel", 71 | "enabled": true, 72 | "email": "noel@test.com", 73 | "firstName": "Noel", 74 | "lastName": "Horton", 75 | "credentials": [ 76 | { 77 | "type": "password", 78 | "value": "test" 79 | } 80 | ], 81 | "realmRoles": [ 82 | "user" 83 | ], 84 | "clientRoles": { 85 | "account": [ 86 | "view-profile", 87 | "manage-account" 88 | ] 89 | } 90 | } 91 | ] 92 | } 93 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # keycloak-in-docker 2 | 3 | [![keep_growing logo](readme-images/logo_250x60.png)](https://keepgrowing.in/) 4 | 5 | ## About this project 6 | 7 | This simple project shows an example Docker configuration for Keycloak. 8 | 9 | To learn how to set up a project like this one, check out the following articles: 10 | 11 | * [Keycloak in Docker #1 – How to run Keycloak in a Docker container](https://keepgrowing.in/tools/keycloak-in-docker-1-how-to-run-keycloak-in-a-docker-container/) 12 | * [Keycloak in Docker #2 – How to import a Keycloak realm](https://keepgrowing.in/tools/keycloak-in-docker-2-how-to-import-a-keycloak-realm/) 13 | * [Keycloak in Docker #3 – How to customise Keycloak themes](https://keepgrowing.in/tools/keycloak-in-docker-3-how-to-customise-keycloak-themes/) 14 | 15 | ## Getting started 16 | 17 | First, [clone](https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/cloning-a-repository-from-github/cloning-a-repository) 18 | this repository. 19 | 20 | Then, start the `keycloak` and `keycloakdb` containers with the following command: 21 | 22 | ```shell 23 | docker-compose -f docker-compose-keycloak.yml up -d 24 | ``` 25 | 26 | Make sure that the `keycloak` container is up. For instance, you can run the `docker ps` command in your terminal: 27 | 28 | ![docker container list screenshot](readme-images/docker-container-list.png) 29 | 30 | The `keycloak` service has a default realm imported from the 31 | [keycloak/realms/realm-export.json](keycloak/realms/realm-export.json) file that specifies all the default users. 32 | Information about the import can be found in the container logs when the service is started for the first time: 33 | 34 | ![imported realm info in container logs screenshot](readme-images/imported-realm-in-logs.png) 35 | 36 | ### Credentials 37 | 38 | Below you'll find a list of default user accounts. 39 | 40 | #### Keycloak admin 41 | 42 | * username: `keycloak` 43 | * password: `keycloak` 44 | 45 | #### Default users 46 | 47 | * usernames: `christina`, `hanna`, `carlo`, `noel` 48 | * password: `test` 49 | * realm role: `user` 50 | 51 | ### Visit Keycloak 52 | 53 | * Visit the [http://localhost:8024/auth](http://localhost:8024/auth) url: 54 | 55 | ![keycloak welcome screen screenshot](readme-images/welcome-screen.png) 56 | 57 | * Select the `Administration Console` option and log in as the Keycloak admin [`keycloak:keycloak`]: 58 | 59 | ![keycloak login screen screenshot](readme-images/keycloak-login.png) 60 | 61 | * As an admin you can see a list of users associated with the `Example-Realm` realm by clicking the `View all users` button on the 62 | [http://localhost:8024/auth/admin/master/console/#/realms/Example-Realm/users](http://localhost:8024/auth/admin/master/console/#/realms/Example-Realm/users) page. 63 | * What's more, you can log in as any user associated with the `Example-Realm` realm by clicking the `Sign in` button on the 64 | [http://localhost:8024/auth/realms/Example-Realm/account](http://localhost:8024/auth/realms/Example-Realm/account) page. 65 | * The realm roles are available under the [http://localhost:8024/auth/admin/master/console/#/realms/Example-Realm/roles](http://localhost:8024/auth/admin/master/console/#/realms/Example-Realm/roles) url. 66 | 67 | ## Features 68 | 69 | * Dockerized Keycloak server and its PostgreSQL database 70 | * Default Example-Realm is imported when the `keycloak` container starts 71 | * Keycloak themes are customized for the Login and Account types: 72 | 73 | ![customised login page screenshot](readme-images/login-customised.png) 74 | 75 | ![customised account page screenshot](readme-images/account-customised.png) 76 | 77 | ## Deploying to production 78 | 79 | The Keycloak theme caching is disabled to allow for fast and convenient theme editing. Remember to re-enable caching in 80 | production as it will significantly impact performance. To do this, remove the 81 | `- ./keycloak/scripts/disable-theme-cache.cli:/opt/jboss/startup-scripts/disable-theme-cache.cli` volume from the 82 | [docker-compose-keycloak.yml](docker-compose-keycloak.yml) file. 83 | 84 | ## Built With 85 | 86 | * [Keycloak](https://www.keycloak.org/) 87 | * [Docker Compose](https://docs.docker.com/compose/) 88 | -------------------------------------------------------------------------------- /keycloak/themes/custom/account/resources/public/logo.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 19 | 21 | 44 | 46 | 47 | 49 | image/svg+xml 50 | 52 | 53 | 54 | 55 | 56 | 61 | 66 | 72 | 78 | 84 | 89 | 94 | 99 | 105 | 111 | 112 | 116 | 120 | 124 | 128 | 132 | 136 | 140 | 144 | 148 | 152 | 156 | 160 | 164 | 165 | 170 | 171 | 172 | -------------------------------------------------------------------------------- /keycloak/realms/realm-export.json: -------------------------------------------------------------------------------- 1 | { 2 | "users": [ 3 | { 4 | "username": "christina", 5 | "enabled": true, 6 | "email": "christina@test.com", 7 | "firstName": "Christina", 8 | "lastName": "Travis", 9 | "credentials": [ 10 | { 11 | "type": "password", 12 | "value": "test" 13 | } 14 | ], 15 | "realmRoles": [ 16 | "user" 17 | ], 18 | "clientRoles": { 19 | "account": [ 20 | "view-profile", 21 | "manage-account" 22 | ] 23 | } 24 | }, 25 | { 26 | "username": "hanna", 27 | "enabled": true, 28 | "email": "hanna@test.com", 29 | "firstName": "Hanna", 30 | "lastName": "Davis", 31 | "credentials": [ 32 | { 33 | "type": "password", 34 | "value": "test" 35 | } 36 | ], 37 | "realmRoles": [ 38 | "user" 39 | ], 40 | "clientRoles": { 41 | "account": [ 42 | "view-profile", 43 | "manage-account" 44 | ] 45 | } 46 | }, 47 | { 48 | "username": "carlo", 49 | "enabled": true, 50 | "email": "carlo@test.com", 51 | "firstName": "Carlo", 52 | "lastName": "Velazquez", 53 | "credentials": [ 54 | { 55 | "type": "password", 56 | "value": "test" 57 | } 58 | ], 59 | "realmRoles": [ 60 | "user" 61 | ], 62 | "clientRoles": { 63 | "account": [ 64 | "view-profile", 65 | "manage-account" 66 | ] 67 | } 68 | }, 69 | { 70 | "username": "noel", 71 | "enabled": true, 72 | "email": "noel@test.com", 73 | "firstName": "Noel", 74 | "lastName": "Horton", 75 | "credentials": [ 76 | { 77 | "type": "password", 78 | "value": "test" 79 | } 80 | ], 81 | "realmRoles": [ 82 | "user" 83 | ], 84 | "clientRoles": { 85 | "account": [ 86 | "view-profile", 87 | "manage-account" 88 | ] 89 | } 90 | } 91 | ], 92 | "id": "Example-Realm", 93 | "realm": "Example-Realm", 94 | "displayName": "Example Realm", 95 | "notBefore": 0, 96 | "defaultSignatureAlgorithm": "RS256", 97 | "revokeRefreshToken": false, 98 | "refreshTokenMaxReuse": 0, 99 | "accessTokenLifespan": 300, 100 | "accessTokenLifespanForImplicitFlow": 900, 101 | "ssoSessionIdleTimeout": 1800, 102 | "ssoSessionMaxLifespan": 36000, 103 | "ssoSessionIdleTimeoutRememberMe": 0, 104 | "ssoSessionMaxLifespanRememberMe": 0, 105 | "offlineSessionIdleTimeout": 2592000, 106 | "offlineSessionMaxLifespanEnabled": false, 107 | "offlineSessionMaxLifespan": 5184000, 108 | "clientSessionIdleTimeout": 0, 109 | "clientSessionMaxLifespan": 0, 110 | "clientOfflineSessionIdleTimeout": 0, 111 | "clientOfflineSessionMaxLifespan": 0, 112 | "accessCodeLifespan": 60, 113 | "accessCodeLifespanUserAction": 300, 114 | "accessCodeLifespanLogin": 1800, 115 | "actionTokenGeneratedByAdminLifespan": 43200, 116 | "actionTokenGeneratedByUserLifespan": 300, 117 | "oauth2DeviceCodeLifespan": 600, 118 | "oauth2DevicePollingInterval": 5, 119 | "enabled": true, 120 | "sslRequired": "external", 121 | "registrationAllowed": true, 122 | "registrationEmailAsUsername": true, 123 | "rememberMe": true, 124 | "verifyEmail": false, 125 | "loginWithEmailAllowed": true, 126 | "duplicateEmailsAllowed": false, 127 | "resetPasswordAllowed": true, 128 | "editUsernameAllowed": true, 129 | "bruteForceProtected": false, 130 | "permanentLockout": false, 131 | "maxFailureWaitSeconds": 900, 132 | "minimumQuickLoginWaitSeconds": 60, 133 | "waitIncrementSeconds": 60, 134 | "quickLoginCheckMilliSeconds": 1000, 135 | "maxDeltaTimeSeconds": 43200, 136 | "failureFactor": 30, 137 | "roles": { 138 | "realm": [ 139 | { 140 | "id": "1d5a18c3-7780-4357-b41b-77d8b7083433", 141 | "name": "offline_access", 142 | "description": "${role_offline-access}", 143 | "composite": false, 144 | "clientRole": false, 145 | "containerId": "Example-Realm", 146 | "attributes": {} 147 | }, 148 | { 149 | "id": "985e237e-d26c-413f-b0a1-d287a6baa37c", 150 | "name": "uma_authorization", 151 | "description": "${role_uma_authorization}", 152 | "composite": false, 153 | "clientRole": false, 154 | "containerId": "Example-Realm", 155 | "attributes": {} 156 | }, 157 | { 158 | "id": "da8b2382-f27c-45ed-b54c-db78ea1631ae", 159 | "name": "default-roles-example-realm", 160 | "description": "${role_default-roles}", 161 | "composite": true, 162 | "composites": { 163 | "realm": [ 164 | "offline_access", 165 | "uma_authorization" 166 | ], 167 | "client": { 168 | "account": [ 169 | "view-profile", 170 | "manage-account" 171 | ] 172 | } 173 | }, 174 | "clientRole": false, 175 | "containerId": "Example-Realm", 176 | "attributes": {} 177 | } 178 | ], 179 | "client": { 180 | "realm-management": [ 181 | { 182 | "id": "16684e54-3cc8-49fa-9922-56c271219ddc", 183 | "name": "query-clients", 184 | "description": "${role_query-clients}", 185 | "composite": false, 186 | "clientRole": true, 187 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 188 | "attributes": {} 189 | }, 190 | { 191 | "id": "64cd5e3e-7637-404e-a910-cc4abec48c4c", 192 | "name": "query-users", 193 | "description": "${role_query-users}", 194 | "composite": false, 195 | "clientRole": true, 196 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 197 | "attributes": {} 198 | }, 199 | { 200 | "id": "c8d69287-1fa8-439a-826b-c84d0cc26c66", 201 | "name": "impersonation", 202 | "description": "${role_impersonation}", 203 | "composite": false, 204 | "clientRole": true, 205 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 206 | "attributes": {} 207 | }, 208 | { 209 | "id": "73f7d181-73ff-451f-9312-1468b6b41b25", 210 | "name": "view-events", 211 | "description": "${role_view-events}", 212 | "composite": false, 213 | "clientRole": true, 214 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 215 | "attributes": {} 216 | }, 217 | { 218 | "id": "d501e124-0d76-428f-a844-a5a68c922ccb", 219 | "name": "manage-events", 220 | "description": "${role_manage-events}", 221 | "composite": false, 222 | "clientRole": true, 223 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 224 | "attributes": {} 225 | }, 226 | { 227 | "id": "f01690f8-f5c0-4303-96a6-1ae762c9720b", 228 | "name": "manage-users", 229 | "description": "${role_manage-users}", 230 | "composite": false, 231 | "clientRole": true, 232 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 233 | "attributes": {} 234 | }, 235 | { 236 | "id": "78f7c954-7ae7-40e0-985a-a86bb004eefe", 237 | "name": "manage-realm", 238 | "description": "${role_manage-realm}", 239 | "composite": false, 240 | "clientRole": true, 241 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 242 | "attributes": {} 243 | }, 244 | { 245 | "id": "f986655f-c179-4bcc-82b5-d02364eeaeb0", 246 | "name": "view-clients", 247 | "description": "${role_view-clients}", 248 | "composite": true, 249 | "composites": { 250 | "client": { 251 | "realm-management": [ 252 | "query-clients" 253 | ] 254 | } 255 | }, 256 | "clientRole": true, 257 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 258 | "attributes": {} 259 | }, 260 | { 261 | "id": "dbc7ad3f-20fb-49a2-b924-f335400d0a79", 262 | "name": "query-groups", 263 | "description": "${role_query-groups}", 264 | "composite": false, 265 | "clientRole": true, 266 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 267 | "attributes": {} 268 | }, 269 | { 270 | "id": "0fc15ac3-c099-4e8d-a5fd-bbf308d73203", 271 | "name": "realm-admin", 272 | "description": "${role_realm-admin}", 273 | "composite": true, 274 | "composites": { 275 | "client": { 276 | "realm-management": [ 277 | "query-clients", 278 | "query-users", 279 | "impersonation", 280 | "view-events", 281 | "manage-events", 282 | "manage-users", 283 | "view-clients", 284 | "manage-realm", 285 | "query-groups", 286 | "create-client", 287 | "manage-identity-providers", 288 | "view-identity-providers", 289 | "query-realms", 290 | "manage-clients", 291 | "view-users", 292 | "view-authorization", 293 | "manage-authorization", 294 | "view-realm" 295 | ] 296 | } 297 | }, 298 | "clientRole": true, 299 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 300 | "attributes": {} 301 | }, 302 | { 303 | "id": "de63cb7e-b79f-4cc9-a6ee-d4f9229cf0aa", 304 | "name": "create-client", 305 | "description": "${role_create-client}", 306 | "composite": false, 307 | "clientRole": true, 308 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 309 | "attributes": {} 310 | }, 311 | { 312 | "id": "f45b26f7-388a-41b1-8b2c-acd48b607f41", 313 | "name": "manage-identity-providers", 314 | "description": "${role_manage-identity-providers}", 315 | "composite": false, 316 | "clientRole": true, 317 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 318 | "attributes": {} 319 | }, 320 | { 321 | "id": "9ad7ae12-618d-4618-ac4a-30a9a28cba5a", 322 | "name": "view-identity-providers", 323 | "description": "${role_view-identity-providers}", 324 | "composite": false, 325 | "clientRole": true, 326 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 327 | "attributes": {} 328 | }, 329 | { 330 | "id": "3103a894-2e83-4ab8-b4bc-3f4433d01688", 331 | "name": "query-realms", 332 | "description": "${role_query-realms}", 333 | "composite": false, 334 | "clientRole": true, 335 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 336 | "attributes": {} 337 | }, 338 | { 339 | "id": "4b0a338f-810b-466a-a171-2d7d5d94d551", 340 | "name": "manage-clients", 341 | "description": "${role_manage-clients}", 342 | "composite": false, 343 | "clientRole": true, 344 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 345 | "attributes": {} 346 | }, 347 | { 348 | "id": "0254f325-4e4d-43f5-8776-16a5bdbdcd7f", 349 | "name": "manage-authorization", 350 | "description": "${role_manage-authorization}", 351 | "composite": false, 352 | "clientRole": true, 353 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 354 | "attributes": {} 355 | }, 356 | { 357 | "id": "a8beae5e-ada9-4524-ae61-7b6dd69ecb74", 358 | "name": "view-authorization", 359 | "description": "${role_view-authorization}", 360 | "composite": false, 361 | "clientRole": true, 362 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 363 | "attributes": {} 364 | }, 365 | { 366 | "id": "a8d1bf63-f0e7-4ce4-9c44-2c187ed3e0d2", 367 | "name": "view-users", 368 | "description": "${role_view-users}", 369 | "composite": true, 370 | "composites": { 371 | "client": { 372 | "realm-management": [ 373 | "query-users", 374 | "query-groups" 375 | ] 376 | } 377 | }, 378 | "clientRole": true, 379 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 380 | "attributes": {} 381 | }, 382 | { 383 | "id": "4ad1aefd-34b2-4ca7-b25e-fad99f4a23f0", 384 | "name": "view-realm", 385 | "description": "${role_view-realm}", 386 | "composite": false, 387 | "clientRole": true, 388 | "containerId": "157d521c-a079-40da-885d-def9a8849cf1", 389 | "attributes": {} 390 | } 391 | ], 392 | "security-admin-console": [], 393 | "admin-cli": [], 394 | "account-console": [], 395 | "broker": [ 396 | { 397 | "id": "66e1d8ff-8d60-4373-aefd-821a51b226aa", 398 | "name": "read-token", 399 | "description": "${role_read-token}", 400 | "composite": false, 401 | "clientRole": true, 402 | "containerId": "2d6e46cf-2d78-47e3-b2ac-1dffd3e6bb5c", 403 | "attributes": {} 404 | } 405 | ], 406 | "account": [ 407 | { 408 | "id": "4280fa7f-b017-409f-84ad-1fc954d2bb7b", 409 | "name": "manage-consent", 410 | "description": "${role_manage-consent}", 411 | "composite": true, 412 | "composites": { 413 | "client": { 414 | "account": [ 415 | "view-consent" 416 | ] 417 | } 418 | }, 419 | "clientRole": true, 420 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 421 | "attributes": {} 422 | }, 423 | { 424 | "id": "cd0be441-c21b-4bcc-a544-7e6bdd52ece4", 425 | "name": "view-applications", 426 | "description": "${role_view-applications}", 427 | "composite": false, 428 | "clientRole": true, 429 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 430 | "attributes": {} 431 | }, 432 | { 433 | "id": "8a75543c-b933-4fd6-9f9e-8c16d763c3ce", 434 | "name": "delete-account", 435 | "description": "${role_delete-account}", 436 | "composite": false, 437 | "clientRole": true, 438 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 439 | "attributes": {} 440 | }, 441 | { 442 | "id": "23a4bec9-bcd7-4b0c-9ec3-52970cae960e", 443 | "name": "view-consent", 444 | "description": "${role_view-consent}", 445 | "composite": false, 446 | "clientRole": true, 447 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 448 | "attributes": {} 449 | }, 450 | { 451 | "id": "d35bc081-57bc-4aa1-aba8-5960a15a91f9", 452 | "name": "view-profile", 453 | "description": "${role_view-profile}", 454 | "composite": false, 455 | "clientRole": true, 456 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 457 | "attributes": {} 458 | }, 459 | { 460 | "id": "d40e46fe-4222-4f7c-847d-061f6d8a7e94", 461 | "name": "manage-account", 462 | "description": "${role_manage-account}", 463 | "composite": true, 464 | "composites": { 465 | "client": { 466 | "account": [ 467 | "manage-account-links" 468 | ] 469 | } 470 | }, 471 | "clientRole": true, 472 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 473 | "attributes": {} 474 | }, 475 | { 476 | "id": "41bbc6de-f209-435d-9f3a-de8230ef9e19", 477 | "name": "manage-account-links", 478 | "description": "${role_manage-account-links}", 479 | "composite": false, 480 | "clientRole": true, 481 | "containerId": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 482 | "attributes": {} 483 | } 484 | ] 485 | } 486 | }, 487 | "groups": [], 488 | "defaultRole": { 489 | "id": "da8b2382-f27c-45ed-b54c-db78ea1631ae", 490 | "name": "default-roles-example-realm", 491 | "description": "${role_default-roles}", 492 | "composite": true, 493 | "clientRole": false, 494 | "containerId": "Example-Realm" 495 | }, 496 | "requiredCredentials": [ 497 | "password" 498 | ], 499 | "otpPolicyType": "totp", 500 | "otpPolicyAlgorithm": "HmacSHA1", 501 | "otpPolicyInitialCounter": 0, 502 | "otpPolicyDigits": 6, 503 | "otpPolicyLookAheadWindow": 1, 504 | "otpPolicyPeriod": 30, 505 | "otpSupportedApplications": [ 506 | "FreeOTP", 507 | "Google Authenticator" 508 | ], 509 | "webAuthnPolicyRpEntityName": "keycloak", 510 | "webAuthnPolicySignatureAlgorithms": [ 511 | "ES256" 512 | ], 513 | "webAuthnPolicyRpId": "", 514 | "webAuthnPolicyAttestationConveyancePreference": "not specified", 515 | "webAuthnPolicyAuthenticatorAttachment": "not specified", 516 | "webAuthnPolicyRequireResidentKey": "not specified", 517 | "webAuthnPolicyUserVerificationRequirement": "not specified", 518 | "webAuthnPolicyCreateTimeout": 0, 519 | "webAuthnPolicyAvoidSameAuthenticatorRegister": false, 520 | "webAuthnPolicyAcceptableAaguids": [], 521 | "webAuthnPolicyPasswordlessRpEntityName": "keycloak", 522 | "webAuthnPolicyPasswordlessSignatureAlgorithms": [ 523 | "ES256" 524 | ], 525 | "webAuthnPolicyPasswordlessRpId": "", 526 | "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified", 527 | "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified", 528 | "webAuthnPolicyPasswordlessRequireResidentKey": "not specified", 529 | "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified", 530 | "webAuthnPolicyPasswordlessCreateTimeout": 0, 531 | "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false, 532 | "webAuthnPolicyPasswordlessAcceptableAaguids": [], 533 | "scopeMappings": [ 534 | { 535 | "clientScope": "offline_access", 536 | "roles": [ 537 | "offline_access" 538 | ] 539 | } 540 | ], 541 | "clientScopeMappings": { 542 | "account": [ 543 | { 544 | "client": "account-console", 545 | "roles": [ 546 | "manage-account" 547 | ] 548 | } 549 | ] 550 | }, 551 | "clients": [ 552 | { 553 | "id": "7f066033-9325-4f69-90a5-ec18a20f6e6d", 554 | "clientId": "account", 555 | "name": "${client_account}", 556 | "rootUrl": "${authBaseUrl}", 557 | "baseUrl": "/realms/Example-Realm/account/", 558 | "surrogateAuthRequired": false, 559 | "enabled": true, 560 | "alwaysDisplayInConsole": false, 561 | "clientAuthenticatorType": "client-secret", 562 | "redirectUris": [ 563 | "/realms/Example-Realm/account/*" 564 | ], 565 | "webOrigins": [], 566 | "notBefore": 0, 567 | "bearerOnly": false, 568 | "consentRequired": false, 569 | "standardFlowEnabled": true, 570 | "implicitFlowEnabled": false, 571 | "directAccessGrantsEnabled": false, 572 | "serviceAccountsEnabled": false, 573 | "publicClient": true, 574 | "frontchannelLogout": false, 575 | "protocol": "openid-connect", 576 | "attributes": {}, 577 | "authenticationFlowBindingOverrides": {}, 578 | "fullScopeAllowed": false, 579 | "nodeReRegistrationTimeout": 0, 580 | "defaultClientScopes": [ 581 | "web-origins", 582 | "roles", 583 | "profile", 584 | "email" 585 | ], 586 | "optionalClientScopes": [ 587 | "address", 588 | "phone", 589 | "offline_access", 590 | "microprofile-jwt" 591 | ] 592 | }, 593 | { 594 | "id": "626a2c49-a385-4935-be87-5f6ae6c76297", 595 | "clientId": "account-console", 596 | "name": "${client_account-console}", 597 | "rootUrl": "${authBaseUrl}", 598 | "baseUrl": "/realms/Example-Realm/account/", 599 | "surrogateAuthRequired": false, 600 | "enabled": true, 601 | "alwaysDisplayInConsole": false, 602 | "clientAuthenticatorType": "client-secret", 603 | "redirectUris": [ 604 | "/realms/Example-Realm/account/*" 605 | ], 606 | "webOrigins": [], 607 | "notBefore": 0, 608 | "bearerOnly": false, 609 | "consentRequired": false, 610 | "standardFlowEnabled": true, 611 | "implicitFlowEnabled": false, 612 | "directAccessGrantsEnabled": false, 613 | "serviceAccountsEnabled": false, 614 | "publicClient": true, 615 | "frontchannelLogout": false, 616 | "protocol": "openid-connect", 617 | "attributes": { 618 | "pkce.code.challenge.method": "S256" 619 | }, 620 | "authenticationFlowBindingOverrides": {}, 621 | "fullScopeAllowed": false, 622 | "nodeReRegistrationTimeout": 0, 623 | "protocolMappers": [ 624 | { 625 | "id": "0482b877-635c-470f-a856-a6954901b880", 626 | "name": "audience resolve", 627 | "protocol": "openid-connect", 628 | "protocolMapper": "oidc-audience-resolve-mapper", 629 | "consentRequired": false, 630 | "config": {} 631 | } 632 | ], 633 | "defaultClientScopes": [ 634 | "web-origins", 635 | "roles", 636 | "profile", 637 | "email" 638 | ], 639 | "optionalClientScopes": [ 640 | "address", 641 | "phone", 642 | "offline_access", 643 | "microprofile-jwt" 644 | ] 645 | }, 646 | { 647 | "id": "d107de4f-5fea-4292-bfda-895ee12a99f5", 648 | "clientId": "admin-cli", 649 | "name": "${client_admin-cli}", 650 | "surrogateAuthRequired": false, 651 | "enabled": true, 652 | "alwaysDisplayInConsole": false, 653 | "clientAuthenticatorType": "client-secret", 654 | "redirectUris": [], 655 | "webOrigins": [], 656 | "notBefore": 0, 657 | "bearerOnly": false, 658 | "consentRequired": false, 659 | "standardFlowEnabled": false, 660 | "implicitFlowEnabled": false, 661 | "directAccessGrantsEnabled": true, 662 | "serviceAccountsEnabled": false, 663 | "publicClient": true, 664 | "frontchannelLogout": false, 665 | "protocol": "openid-connect", 666 | "attributes": {}, 667 | "authenticationFlowBindingOverrides": {}, 668 | "fullScopeAllowed": false, 669 | "nodeReRegistrationTimeout": 0, 670 | "defaultClientScopes": [ 671 | "web-origins", 672 | "roles", 673 | "profile", 674 | "email" 675 | ], 676 | "optionalClientScopes": [ 677 | "address", 678 | "phone", 679 | "offline_access", 680 | "microprofile-jwt" 681 | ] 682 | }, 683 | { 684 | "id": "2d6e46cf-2d78-47e3-b2ac-1dffd3e6bb5c", 685 | "clientId": "broker", 686 | "name": "${client_broker}", 687 | "surrogateAuthRequired": false, 688 | "enabled": true, 689 | "alwaysDisplayInConsole": false, 690 | "clientAuthenticatorType": "client-secret", 691 | "redirectUris": [], 692 | "webOrigins": [], 693 | "notBefore": 0, 694 | "bearerOnly": true, 695 | "consentRequired": false, 696 | "standardFlowEnabled": true, 697 | "implicitFlowEnabled": false, 698 | "directAccessGrantsEnabled": false, 699 | "serviceAccountsEnabled": false, 700 | "publicClient": false, 701 | "frontchannelLogout": false, 702 | "protocol": "openid-connect", 703 | "attributes": {}, 704 | "authenticationFlowBindingOverrides": {}, 705 | "fullScopeAllowed": false, 706 | "nodeReRegistrationTimeout": 0, 707 | "defaultClientScopes": [ 708 | "web-origins", 709 | "roles", 710 | "profile", 711 | "email" 712 | ], 713 | "optionalClientScopes": [ 714 | "address", 715 | "phone", 716 | "offline_access", 717 | "microprofile-jwt" 718 | ] 719 | }, 720 | { 721 | "id": "157d521c-a079-40da-885d-def9a8849cf1", 722 | "clientId": "realm-management", 723 | "name": "${client_realm-management}", 724 | "surrogateAuthRequired": false, 725 | "enabled": true, 726 | "alwaysDisplayInConsole": false, 727 | "clientAuthenticatorType": "client-secret", 728 | "redirectUris": [], 729 | "webOrigins": [], 730 | "notBefore": 0, 731 | "bearerOnly": true, 732 | "consentRequired": false, 733 | "standardFlowEnabled": true, 734 | "implicitFlowEnabled": false, 735 | "directAccessGrantsEnabled": false, 736 | "serviceAccountsEnabled": false, 737 | "publicClient": false, 738 | "frontchannelLogout": false, 739 | "protocol": "openid-connect", 740 | "attributes": {}, 741 | "authenticationFlowBindingOverrides": {}, 742 | "fullScopeAllowed": false, 743 | "nodeReRegistrationTimeout": 0, 744 | "defaultClientScopes": [ 745 | "web-origins", 746 | "roles", 747 | "profile", 748 | "email" 749 | ], 750 | "optionalClientScopes": [ 751 | "address", 752 | "phone", 753 | "offline_access", 754 | "microprofile-jwt" 755 | ] 756 | }, 757 | { 758 | "id": "fc91d8b6-a41c-47fb-a81f-464c202f80cb", 759 | "clientId": "security-admin-console", 760 | "name": "${client_security-admin-console}", 761 | "rootUrl": "${authAdminUrl}", 762 | "baseUrl": "/admin/Example-Realm/console/", 763 | "surrogateAuthRequired": false, 764 | "enabled": true, 765 | "alwaysDisplayInConsole": false, 766 | "clientAuthenticatorType": "client-secret", 767 | "redirectUris": [ 768 | "/admin/Example-Realm/console/*" 769 | ], 770 | "webOrigins": [ 771 | "+" 772 | ], 773 | "notBefore": 0, 774 | "bearerOnly": false, 775 | "consentRequired": false, 776 | "standardFlowEnabled": true, 777 | "implicitFlowEnabled": false, 778 | "directAccessGrantsEnabled": false, 779 | "serviceAccountsEnabled": false, 780 | "publicClient": true, 781 | "frontchannelLogout": false, 782 | "protocol": "openid-connect", 783 | "attributes": { 784 | "pkce.code.challenge.method": "S256" 785 | }, 786 | "authenticationFlowBindingOverrides": {}, 787 | "fullScopeAllowed": false, 788 | "nodeReRegistrationTimeout": 0, 789 | "protocolMappers": [ 790 | { 791 | "id": "40cacafd-9ef3-448a-bbd0-87a9e81b83a5", 792 | "name": "locale", 793 | "protocol": "openid-connect", 794 | "protocolMapper": "oidc-usermodel-attribute-mapper", 795 | "consentRequired": false, 796 | "config": { 797 | "userinfo.token.claim": "true", 798 | "user.attribute": "locale", 799 | "id.token.claim": "true", 800 | "access.token.claim": "true", 801 | "claim.name": "locale", 802 | "jsonType.label": "String" 803 | } 804 | } 805 | ], 806 | "defaultClientScopes": [ 807 | "web-origins", 808 | "roles", 809 | "profile", 810 | "email" 811 | ], 812 | "optionalClientScopes": [ 813 | "address", 814 | "phone", 815 | "offline_access", 816 | "microprofile-jwt" 817 | ] 818 | } 819 | ], 820 | "clientScopes": [ 821 | { 822 | "id": "c2254c63-67a0-4ed9-bfb0-a39436fc2919", 823 | "name": "email", 824 | "description": "OpenID Connect built-in scope: email", 825 | "protocol": "openid-connect", 826 | "attributes": { 827 | "include.in.token.scope": "true", 828 | "display.on.consent.screen": "true", 829 | "consent.screen.text": "${emailScopeConsentText}" 830 | }, 831 | "protocolMappers": [ 832 | { 833 | "id": "bf0aabc2-e7af-4365-817e-7517e1aafc38", 834 | "name": "email", 835 | "protocol": "openid-connect", 836 | "protocolMapper": "oidc-usermodel-property-mapper", 837 | "consentRequired": false, 838 | "config": { 839 | "userinfo.token.claim": "true", 840 | "user.attribute": "email", 841 | "id.token.claim": "true", 842 | "access.token.claim": "true", 843 | "claim.name": "email", 844 | "jsonType.label": "String" 845 | } 846 | }, 847 | { 848 | "id": "215ea261-7d34-4953-9eb1-03ddf821ef90", 849 | "name": "email verified", 850 | "protocol": "openid-connect", 851 | "protocolMapper": "oidc-usermodel-property-mapper", 852 | "consentRequired": false, 853 | "config": { 854 | "userinfo.token.claim": "true", 855 | "user.attribute": "emailVerified", 856 | "id.token.claim": "true", 857 | "access.token.claim": "true", 858 | "claim.name": "email_verified", 859 | "jsonType.label": "boolean" 860 | } 861 | } 862 | ] 863 | }, 864 | { 865 | "id": "7afabc8c-510d-4239-96c7-77b414038dcb", 866 | "name": "roles", 867 | "description": "OpenID Connect scope for add user roles to the access token", 868 | "protocol": "openid-connect", 869 | "attributes": { 870 | "include.in.token.scope": "false", 871 | "display.on.consent.screen": "true", 872 | "consent.screen.text": "${rolesScopeConsentText}" 873 | }, 874 | "protocolMappers": [ 875 | { 876 | "id": "cd5ecfed-07fe-4760-9113-ee355be74a3c", 877 | "name": "audience resolve", 878 | "protocol": "openid-connect", 879 | "protocolMapper": "oidc-audience-resolve-mapper", 880 | "consentRequired": false, 881 | "config": {} 882 | }, 883 | { 884 | "id": "d39f0e7b-834d-436a-82d7-5268617c5f82", 885 | "name": "client roles", 886 | "protocol": "openid-connect", 887 | "protocolMapper": "oidc-usermodel-client-role-mapper", 888 | "consentRequired": false, 889 | "config": { 890 | "user.attribute": "foo", 891 | "access.token.claim": "true", 892 | "claim.name": "resource_access.${client_id}.roles", 893 | "jsonType.label": "String", 894 | "multivalued": "true" 895 | } 896 | }, 897 | { 898 | "id": "59d7ea28-d9fe-4e2b-92dc-186fc1088cb4", 899 | "name": "realm roles", 900 | "protocol": "openid-connect", 901 | "protocolMapper": "oidc-usermodel-realm-role-mapper", 902 | "consentRequired": false, 903 | "config": { 904 | "user.attribute": "foo", 905 | "access.token.claim": "true", 906 | "claim.name": "realm_access.roles", 907 | "jsonType.label": "String", 908 | "multivalued": "true" 909 | } 910 | } 911 | ] 912 | }, 913 | { 914 | "id": "1f69b373-dfba-46f7-9933-01369c9b16af", 915 | "name": "offline_access", 916 | "description": "OpenID Connect built-in scope: offline_access", 917 | "protocol": "openid-connect", 918 | "attributes": { 919 | "consent.screen.text": "${offlineAccessScopeConsentText}", 920 | "display.on.consent.screen": "true" 921 | } 922 | }, 923 | { 924 | "id": "eeb42ce7-ffda-4526-8350-c7067bf204f9", 925 | "name": "phone", 926 | "description": "OpenID Connect built-in scope: phone", 927 | "protocol": "openid-connect", 928 | "attributes": { 929 | "include.in.token.scope": "true", 930 | "display.on.consent.screen": "true", 931 | "consent.screen.text": "${phoneScopeConsentText}" 932 | }, 933 | "protocolMappers": [ 934 | { 935 | "id": "bf35d87c-35d3-4bcb-b1f5-47231cf24840", 936 | "name": "phone number verified", 937 | "protocol": "openid-connect", 938 | "protocolMapper": "oidc-usermodel-attribute-mapper", 939 | "consentRequired": false, 940 | "config": { 941 | "userinfo.token.claim": "true", 942 | "user.attribute": "phoneNumberVerified", 943 | "id.token.claim": "true", 944 | "access.token.claim": "true", 945 | "claim.name": "phone_number_verified", 946 | "jsonType.label": "boolean" 947 | } 948 | }, 949 | { 950 | "id": "eee80668-b0a5-4d02-bada-62e64e888add", 951 | "name": "phone number", 952 | "protocol": "openid-connect", 953 | "protocolMapper": "oidc-usermodel-attribute-mapper", 954 | "consentRequired": false, 955 | "config": { 956 | "userinfo.token.claim": "true", 957 | "user.attribute": "phoneNumber", 958 | "id.token.claim": "true", 959 | "access.token.claim": "true", 960 | "claim.name": "phone_number", 961 | "jsonType.label": "String" 962 | } 963 | } 964 | ] 965 | }, 966 | { 967 | "id": "c893e7f2-b1fc-498a-b941-7b1f9ad45e90", 968 | "name": "microprofile-jwt", 969 | "description": "Microprofile - JWT built-in scope", 970 | "protocol": "openid-connect", 971 | "attributes": { 972 | "include.in.token.scope": "true", 973 | "display.on.consent.screen": "false" 974 | }, 975 | "protocolMappers": [ 976 | { 977 | "id": "ef5a4a03-7eb6-4bcc-bca9-0122a30d0feb", 978 | "name": "groups", 979 | "protocol": "openid-connect", 980 | "protocolMapper": "oidc-usermodel-realm-role-mapper", 981 | "consentRequired": false, 982 | "config": { 983 | "multivalued": "true", 984 | "user.attribute": "foo", 985 | "id.token.claim": "true", 986 | "access.token.claim": "true", 987 | "claim.name": "groups", 988 | "jsonType.label": "String" 989 | } 990 | }, 991 | { 992 | "id": "2371d627-fd2f-483d-8a65-06e9d2eb618e", 993 | "name": "upn", 994 | "protocol": "openid-connect", 995 | "protocolMapper": "oidc-usermodel-property-mapper", 996 | "consentRequired": false, 997 | "config": { 998 | "userinfo.token.claim": "true", 999 | "user.attribute": "username", 1000 | "id.token.claim": "true", 1001 | "access.token.claim": "true", 1002 | "claim.name": "upn", 1003 | "jsonType.label": "String" 1004 | } 1005 | } 1006 | ] 1007 | }, 1008 | { 1009 | "id": "73114058-3863-452d-8071-d33d7788ceaa", 1010 | "name": "web-origins", 1011 | "description": "OpenID Connect scope for add allowed web origins to the access token", 1012 | "protocol": "openid-connect", 1013 | "attributes": { 1014 | "include.in.token.scope": "false", 1015 | "display.on.consent.screen": "false", 1016 | "consent.screen.text": "" 1017 | }, 1018 | "protocolMappers": [ 1019 | { 1020 | "id": "835bb168-3a76-421b-b93a-97b2fc014add", 1021 | "name": "allowed web origins", 1022 | "protocol": "openid-connect", 1023 | "protocolMapper": "oidc-allowed-origins-mapper", 1024 | "consentRequired": false, 1025 | "config": {} 1026 | } 1027 | ] 1028 | }, 1029 | { 1030 | "id": "af04c4d4-084e-4e23-a020-3660a3863751", 1031 | "name": "role_list", 1032 | "description": "SAML role list", 1033 | "protocol": "saml", 1034 | "attributes": { 1035 | "consent.screen.text": "${samlRoleListScopeConsentText}", 1036 | "display.on.consent.screen": "true" 1037 | }, 1038 | "protocolMappers": [ 1039 | { 1040 | "id": "a8b7f9c3-cb89-4c94-b075-4a0b59fd310f", 1041 | "name": "role list", 1042 | "protocol": "saml", 1043 | "protocolMapper": "saml-role-list-mapper", 1044 | "consentRequired": false, 1045 | "config": { 1046 | "single": "false", 1047 | "attribute.nameformat": "Basic", 1048 | "attribute.name": "Role" 1049 | } 1050 | } 1051 | ] 1052 | }, 1053 | { 1054 | "id": "6c2162bc-1b97-46a9-891a-def272e6af54", 1055 | "name": "address", 1056 | "description": "OpenID Connect built-in scope: address", 1057 | "protocol": "openid-connect", 1058 | "attributes": { 1059 | "include.in.token.scope": "true", 1060 | "display.on.consent.screen": "true", 1061 | "consent.screen.text": "${addressScopeConsentText}" 1062 | }, 1063 | "protocolMappers": [ 1064 | { 1065 | "id": "65d1e0dc-b990-4e36-aae4-afdf3e3f48f6", 1066 | "name": "address", 1067 | "protocol": "openid-connect", 1068 | "protocolMapper": "oidc-address-mapper", 1069 | "consentRequired": false, 1070 | "config": { 1071 | "user.attribute.formatted": "formatted", 1072 | "user.attribute.country": "country", 1073 | "user.attribute.postal_code": "postal_code", 1074 | "userinfo.token.claim": "true", 1075 | "user.attribute.street": "street", 1076 | "id.token.claim": "true", 1077 | "user.attribute.region": "region", 1078 | "access.token.claim": "true", 1079 | "user.attribute.locality": "locality" 1080 | } 1081 | } 1082 | ] 1083 | }, 1084 | { 1085 | "id": "66ecb9fb-986f-4b4c-9da7-6b38f8444c8c", 1086 | "name": "profile", 1087 | "description": "OpenID Connect built-in scope: profile", 1088 | "protocol": "openid-connect", 1089 | "attributes": { 1090 | "include.in.token.scope": "true", 1091 | "display.on.consent.screen": "true", 1092 | "consent.screen.text": "${profileScopeConsentText}" 1093 | }, 1094 | "protocolMappers": [ 1095 | { 1096 | "id": "16ec3d35-787d-4ae2-95fb-3d64b585c031", 1097 | "name": "birthdate", 1098 | "protocol": "openid-connect", 1099 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1100 | "consentRequired": false, 1101 | "config": { 1102 | "userinfo.token.claim": "true", 1103 | "user.attribute": "birthdate", 1104 | "id.token.claim": "true", 1105 | "access.token.claim": "true", 1106 | "claim.name": "birthdate", 1107 | "jsonType.label": "String" 1108 | } 1109 | }, 1110 | { 1111 | "id": "10d1056e-4744-419b-972d-49196cc5e80c", 1112 | "name": "gender", 1113 | "protocol": "openid-connect", 1114 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1115 | "consentRequired": false, 1116 | "config": { 1117 | "userinfo.token.claim": "true", 1118 | "user.attribute": "gender", 1119 | "id.token.claim": "true", 1120 | "access.token.claim": "true", 1121 | "claim.name": "gender", 1122 | "jsonType.label": "String" 1123 | } 1124 | }, 1125 | { 1126 | "id": "ae9efdda-7ce6-4df4-b070-d65348339eab", 1127 | "name": "middle name", 1128 | "protocol": "openid-connect", 1129 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1130 | "consentRequired": false, 1131 | "config": { 1132 | "userinfo.token.claim": "true", 1133 | "user.attribute": "middleName", 1134 | "id.token.claim": "true", 1135 | "access.token.claim": "true", 1136 | "claim.name": "middle_name", 1137 | "jsonType.label": "String" 1138 | } 1139 | }, 1140 | { 1141 | "id": "ccf20f94-72a0-482c-a117-11eb26feb0c4", 1142 | "name": "family name", 1143 | "protocol": "openid-connect", 1144 | "protocolMapper": "oidc-usermodel-property-mapper", 1145 | "consentRequired": false, 1146 | "config": { 1147 | "userinfo.token.claim": "true", 1148 | "user.attribute": "lastName", 1149 | "id.token.claim": "true", 1150 | "access.token.claim": "true", 1151 | "claim.name": "family_name", 1152 | "jsonType.label": "String" 1153 | } 1154 | }, 1155 | { 1156 | "id": "1d161090-1ed0-4b39-9ff5-f1c6bde63558", 1157 | "name": "website", 1158 | "protocol": "openid-connect", 1159 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1160 | "consentRequired": false, 1161 | "config": { 1162 | "userinfo.token.claim": "true", 1163 | "user.attribute": "website", 1164 | "id.token.claim": "true", 1165 | "access.token.claim": "true", 1166 | "claim.name": "website", 1167 | "jsonType.label": "String" 1168 | } 1169 | }, 1170 | { 1171 | "id": "a2b62d3d-5209-4287-9db6-bcd5956021cb", 1172 | "name": "full name", 1173 | "protocol": "openid-connect", 1174 | "protocolMapper": "oidc-full-name-mapper", 1175 | "consentRequired": false, 1176 | "config": { 1177 | "id.token.claim": "true", 1178 | "access.token.claim": "true", 1179 | "userinfo.token.claim": "true" 1180 | } 1181 | }, 1182 | { 1183 | "id": "71f4c24b-3a65-4f57-80b3-7115a1f1605a", 1184 | "name": "username", 1185 | "protocol": "openid-connect", 1186 | "protocolMapper": "oidc-usermodel-property-mapper", 1187 | "consentRequired": false, 1188 | "config": { 1189 | "userinfo.token.claim": "true", 1190 | "user.attribute": "username", 1191 | "id.token.claim": "true", 1192 | "access.token.claim": "true", 1193 | "claim.name": "preferred_username", 1194 | "jsonType.label": "String" 1195 | } 1196 | }, 1197 | { 1198 | "id": "9a5fa99c-c5b2-471d-b80a-061fff668648", 1199 | "name": "picture", 1200 | "protocol": "openid-connect", 1201 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1202 | "consentRequired": false, 1203 | "config": { 1204 | "userinfo.token.claim": "true", 1205 | "user.attribute": "picture", 1206 | "id.token.claim": "true", 1207 | "access.token.claim": "true", 1208 | "claim.name": "picture", 1209 | "jsonType.label": "String" 1210 | } 1211 | }, 1212 | { 1213 | "id": "ce2342e3-655f-4743-8829-bdb329ef1754", 1214 | "name": "nickname", 1215 | "protocol": "openid-connect", 1216 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1217 | "consentRequired": false, 1218 | "config": { 1219 | "userinfo.token.claim": "true", 1220 | "user.attribute": "nickname", 1221 | "id.token.claim": "true", 1222 | "access.token.claim": "true", 1223 | "claim.name": "nickname", 1224 | "jsonType.label": "String" 1225 | } 1226 | }, 1227 | { 1228 | "id": "7c860344-504c-4660-b6f7-8bc8f838f206", 1229 | "name": "profile", 1230 | "protocol": "openid-connect", 1231 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1232 | "consentRequired": false, 1233 | "config": { 1234 | "userinfo.token.claim": "true", 1235 | "user.attribute": "profile", 1236 | "id.token.claim": "true", 1237 | "access.token.claim": "true", 1238 | "claim.name": "profile", 1239 | "jsonType.label": "String" 1240 | } 1241 | }, 1242 | { 1243 | "id": "7eba8520-638b-414a-b2ec-ddf27ff80173", 1244 | "name": "given name", 1245 | "protocol": "openid-connect", 1246 | "protocolMapper": "oidc-usermodel-property-mapper", 1247 | "consentRequired": false, 1248 | "config": { 1249 | "userinfo.token.claim": "true", 1250 | "user.attribute": "firstName", 1251 | "id.token.claim": "true", 1252 | "access.token.claim": "true", 1253 | "claim.name": "given_name", 1254 | "jsonType.label": "String" 1255 | } 1256 | }, 1257 | { 1258 | "id": "14986c60-8a2f-4771-99a1-75c61d5bbd33", 1259 | "name": "updated at", 1260 | "protocol": "openid-connect", 1261 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1262 | "consentRequired": false, 1263 | "config": { 1264 | "userinfo.token.claim": "true", 1265 | "user.attribute": "updatedAt", 1266 | "id.token.claim": "true", 1267 | "access.token.claim": "true", 1268 | "claim.name": "updated_at", 1269 | "jsonType.label": "String" 1270 | } 1271 | }, 1272 | { 1273 | "id": "94408c62-33ac-464a-bd42-8317854ce799", 1274 | "name": "locale", 1275 | "protocol": "openid-connect", 1276 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1277 | "consentRequired": false, 1278 | "config": { 1279 | "userinfo.token.claim": "true", 1280 | "user.attribute": "locale", 1281 | "id.token.claim": "true", 1282 | "access.token.claim": "true", 1283 | "claim.name": "locale", 1284 | "jsonType.label": "String" 1285 | } 1286 | }, 1287 | { 1288 | "id": "b2e2309c-87cc-4b2d-98d1-57c3ca76b390", 1289 | "name": "zoneinfo", 1290 | "protocol": "openid-connect", 1291 | "protocolMapper": "oidc-usermodel-attribute-mapper", 1292 | "consentRequired": false, 1293 | "config": { 1294 | "userinfo.token.claim": "true", 1295 | "user.attribute": "zoneinfo", 1296 | "id.token.claim": "true", 1297 | "access.token.claim": "true", 1298 | "claim.name": "zoneinfo", 1299 | "jsonType.label": "String" 1300 | } 1301 | } 1302 | ] 1303 | } 1304 | ], 1305 | "defaultDefaultClientScopes": [ 1306 | "role_list", 1307 | "profile", 1308 | "email", 1309 | "roles", 1310 | "web-origins" 1311 | ], 1312 | "defaultOptionalClientScopes": [ 1313 | "offline_access", 1314 | "address", 1315 | "phone", 1316 | "microprofile-jwt" 1317 | ], 1318 | "browserSecurityHeaders": { 1319 | "contentSecurityPolicyReportOnly": "", 1320 | "xContentTypeOptions": "nosniff", 1321 | "xRobotsTag": "none", 1322 | "xFrameOptions": "SAMEORIGIN", 1323 | "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';", 1324 | "xXSSProtection": "1; mode=block", 1325 | "strictTransportSecurity": "max-age=31536000; includeSubDomains" 1326 | }, 1327 | "smtpServer": {}, 1328 | "eventsEnabled": false, 1329 | "eventsListeners": [ 1330 | "jboss-logging" 1331 | ], 1332 | "enabledEventTypes": [], 1333 | "adminEventsEnabled": false, 1334 | "adminEventsDetailsEnabled": false, 1335 | "identityProviders": [], 1336 | "identityProviderMappers": [], 1337 | "components": { 1338 | "org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [ 1339 | { 1340 | "id": "ae06c5f0-d859-4471-80e3-04aa08e8b5cc", 1341 | "name": "Allowed Client Scopes", 1342 | "providerId": "allowed-client-templates", 1343 | "subType": "authenticated", 1344 | "subComponents": {}, 1345 | "config": { 1346 | "allow-default-scopes": [ 1347 | "true" 1348 | ] 1349 | } 1350 | }, 1351 | { 1352 | "id": "c60b2bdb-22cc-49ce-afeb-2e3030ff056b", 1353 | "name": "Allowed Protocol Mapper Types", 1354 | "providerId": "allowed-protocol-mappers", 1355 | "subType": "authenticated", 1356 | "subComponents": {}, 1357 | "config": { 1358 | "allowed-protocol-mapper-types": [ 1359 | "oidc-sha256-pairwise-sub-mapper", 1360 | "oidc-usermodel-property-mapper", 1361 | "saml-user-attribute-mapper", 1362 | "saml-user-property-mapper", 1363 | "oidc-full-name-mapper", 1364 | "oidc-address-mapper", 1365 | "saml-role-list-mapper", 1366 | "oidc-usermodel-attribute-mapper" 1367 | ] 1368 | } 1369 | }, 1370 | { 1371 | "id": "d89522b2-a7c6-4cc5-9496-953fb7e40391", 1372 | "name": "Trusted Hosts", 1373 | "providerId": "trusted-hosts", 1374 | "subType": "anonymous", 1375 | "subComponents": {}, 1376 | "config": { 1377 | "host-sending-registration-request-must-match": [ 1378 | "true" 1379 | ], 1380 | "client-uris-must-match": [ 1381 | "true" 1382 | ] 1383 | } 1384 | }, 1385 | { 1386 | "id": "376832d5-291a-4527-b04c-9a770f032e6d", 1387 | "name": "Allowed Protocol Mapper Types", 1388 | "providerId": "allowed-protocol-mappers", 1389 | "subType": "anonymous", 1390 | "subComponents": {}, 1391 | "config": { 1392 | "allowed-protocol-mapper-types": [ 1393 | "saml-user-attribute-mapper", 1394 | "oidc-full-name-mapper", 1395 | "saml-user-property-mapper", 1396 | "saml-role-list-mapper", 1397 | "oidc-sha256-pairwise-sub-mapper", 1398 | "oidc-address-mapper", 1399 | "oidc-usermodel-attribute-mapper", 1400 | "oidc-usermodel-property-mapper" 1401 | ] 1402 | } 1403 | }, 1404 | { 1405 | "id": "b95b6e64-5482-45f3-b481-fcfbee9da175", 1406 | "name": "Full Scope Disabled", 1407 | "providerId": "scope", 1408 | "subType": "anonymous", 1409 | "subComponents": {}, 1410 | "config": {} 1411 | }, 1412 | { 1413 | "id": "0082f1c7-8531-4b1f-8bbd-93a350cc0a2d", 1414 | "name": "Allowed Client Scopes", 1415 | "providerId": "allowed-client-templates", 1416 | "subType": "anonymous", 1417 | "subComponents": {}, 1418 | "config": { 1419 | "allow-default-scopes": [ 1420 | "true" 1421 | ] 1422 | } 1423 | }, 1424 | { 1425 | "id": "71af80a5-b100-47b1-b4b2-f598d8bb129e", 1426 | "name": "Consent Required", 1427 | "providerId": "consent-required", 1428 | "subType": "anonymous", 1429 | "subComponents": {}, 1430 | "config": {} 1431 | }, 1432 | { 1433 | "id": "89d718db-4f26-40a2-bd3d-c8c323adacda", 1434 | "name": "Max Clients Limit", 1435 | "providerId": "max-clients", 1436 | "subType": "anonymous", 1437 | "subComponents": {}, 1438 | "config": { 1439 | "max-clients": [ 1440 | "200" 1441 | ] 1442 | } 1443 | } 1444 | ], 1445 | "org.keycloak.keys.KeyProvider": [ 1446 | { 1447 | "id": "cf986552-ca0a-44fb-b92f-4e42104a4a89", 1448 | "name": "hmac-generated", 1449 | "providerId": "hmac-generated", 1450 | "subComponents": {}, 1451 | "config": { 1452 | "priority": [ 1453 | "100" 1454 | ], 1455 | "algorithm": [ 1456 | "HS256" 1457 | ] 1458 | } 1459 | }, 1460 | { 1461 | "id": "6596b411-44a1-4e39-9687-fda7533848a2", 1462 | "name": "aes-generated", 1463 | "providerId": "aes-generated", 1464 | "subComponents": {}, 1465 | "config": { 1466 | "priority": [ 1467 | "100" 1468 | ] 1469 | } 1470 | }, 1471 | { 1472 | "id": "c621d151-da3d-4135-b631-30f472d14821", 1473 | "name": "rsa-generated", 1474 | "providerId": "rsa-generated", 1475 | "subComponents": {}, 1476 | "config": { 1477 | "keyUse": [ 1478 | "sig" 1479 | ], 1480 | "priority": [ 1481 | "100" 1482 | ] 1483 | } 1484 | }, 1485 | { 1486 | "id": "71c178d0-d07b-4197-9cee-b0c55bdc3ae1", 1487 | "name": "rsa-enc-generated", 1488 | "providerId": "rsa-generated", 1489 | "subComponents": {}, 1490 | "config": { 1491 | "keyUse": [ 1492 | "enc" 1493 | ], 1494 | "priority": [ 1495 | "100" 1496 | ] 1497 | } 1498 | } 1499 | ] 1500 | }, 1501 | "internationalizationEnabled": false, 1502 | "supportedLocales": [], 1503 | "authenticationFlows": [ 1504 | { 1505 | "id": "7e6b2163-99e7-456c-887c-ad346b29261e", 1506 | "alias": "Account verification options", 1507 | "description": "Method with which to verity the existing account", 1508 | "providerId": "basic-flow", 1509 | "topLevel": false, 1510 | "builtIn": true, 1511 | "authenticationExecutions": [ 1512 | { 1513 | "authenticator": "idp-email-verification", 1514 | "authenticatorFlow": false, 1515 | "requirement": "ALTERNATIVE", 1516 | "priority": 10, 1517 | "userSetupAllowed": false, 1518 | "autheticatorFlow": false 1519 | }, 1520 | { 1521 | "authenticatorFlow": true, 1522 | "requirement": "ALTERNATIVE", 1523 | "priority": 20, 1524 | "flowAlias": "Verify Existing Account by Re-authentication", 1525 | "userSetupAllowed": false, 1526 | "autheticatorFlow": true 1527 | } 1528 | ] 1529 | }, 1530 | { 1531 | "id": "59eca710-4124-43db-a570-e9b5427c84a8", 1532 | "alias": "Authentication Options", 1533 | "description": "Authentication options.", 1534 | "providerId": "basic-flow", 1535 | "topLevel": false, 1536 | "builtIn": true, 1537 | "authenticationExecutions": [ 1538 | { 1539 | "authenticator": "basic-auth", 1540 | "authenticatorFlow": false, 1541 | "requirement": "REQUIRED", 1542 | "priority": 10, 1543 | "userSetupAllowed": false, 1544 | "autheticatorFlow": false 1545 | }, 1546 | { 1547 | "authenticator": "basic-auth-otp", 1548 | "authenticatorFlow": false, 1549 | "requirement": "DISABLED", 1550 | "priority": 20, 1551 | "userSetupAllowed": false, 1552 | "autheticatorFlow": false 1553 | }, 1554 | { 1555 | "authenticator": "auth-spnego", 1556 | "authenticatorFlow": false, 1557 | "requirement": "DISABLED", 1558 | "priority": 30, 1559 | "userSetupAllowed": false, 1560 | "autheticatorFlow": false 1561 | } 1562 | ] 1563 | }, 1564 | { 1565 | "id": "d3e3198d-22db-4af4-8cd9-108c4172c379", 1566 | "alias": "Browser - Conditional OTP", 1567 | "description": "Flow to determine if the OTP is required for the authentication", 1568 | "providerId": "basic-flow", 1569 | "topLevel": false, 1570 | "builtIn": true, 1571 | "authenticationExecutions": [ 1572 | { 1573 | "authenticator": "conditional-user-configured", 1574 | "authenticatorFlow": false, 1575 | "requirement": "REQUIRED", 1576 | "priority": 10, 1577 | "userSetupAllowed": false, 1578 | "autheticatorFlow": false 1579 | }, 1580 | { 1581 | "authenticator": "auth-otp-form", 1582 | "authenticatorFlow": false, 1583 | "requirement": "REQUIRED", 1584 | "priority": 20, 1585 | "userSetupAllowed": false, 1586 | "autheticatorFlow": false 1587 | } 1588 | ] 1589 | }, 1590 | { 1591 | "id": "6422178f-a377-4fce-8886-f4bca69d1ea0", 1592 | "alias": "Direct Grant - Conditional OTP", 1593 | "description": "Flow to determine if the OTP is required for the authentication", 1594 | "providerId": "basic-flow", 1595 | "topLevel": false, 1596 | "builtIn": true, 1597 | "authenticationExecutions": [ 1598 | { 1599 | "authenticator": "conditional-user-configured", 1600 | "authenticatorFlow": false, 1601 | "requirement": "REQUIRED", 1602 | "priority": 10, 1603 | "userSetupAllowed": false, 1604 | "autheticatorFlow": false 1605 | }, 1606 | { 1607 | "authenticator": "direct-grant-validate-otp", 1608 | "authenticatorFlow": false, 1609 | "requirement": "REQUIRED", 1610 | "priority": 20, 1611 | "userSetupAllowed": false, 1612 | "autheticatorFlow": false 1613 | } 1614 | ] 1615 | }, 1616 | { 1617 | "id": "d9177e29-456e-4d6c-901f-0377b794d635", 1618 | "alias": "First broker login - Conditional OTP", 1619 | "description": "Flow to determine if the OTP is required for the authentication", 1620 | "providerId": "basic-flow", 1621 | "topLevel": false, 1622 | "builtIn": true, 1623 | "authenticationExecutions": [ 1624 | { 1625 | "authenticator": "conditional-user-configured", 1626 | "authenticatorFlow": false, 1627 | "requirement": "REQUIRED", 1628 | "priority": 10, 1629 | "userSetupAllowed": false, 1630 | "autheticatorFlow": false 1631 | }, 1632 | { 1633 | "authenticator": "auth-otp-form", 1634 | "authenticatorFlow": false, 1635 | "requirement": "REQUIRED", 1636 | "priority": 20, 1637 | "userSetupAllowed": false, 1638 | "autheticatorFlow": false 1639 | } 1640 | ] 1641 | }, 1642 | { 1643 | "id": "3a328020-c7b5-4c99-8662-52fc0ab0c208", 1644 | "alias": "Handle Existing Account", 1645 | "description": "Handle what to do if there is existing account with same email/username like authenticated identity provider", 1646 | "providerId": "basic-flow", 1647 | "topLevel": false, 1648 | "builtIn": true, 1649 | "authenticationExecutions": [ 1650 | { 1651 | "authenticator": "idp-confirm-link", 1652 | "authenticatorFlow": false, 1653 | "requirement": "REQUIRED", 1654 | "priority": 10, 1655 | "userSetupAllowed": false, 1656 | "autheticatorFlow": false 1657 | }, 1658 | { 1659 | "authenticatorFlow": true, 1660 | "requirement": "REQUIRED", 1661 | "priority": 20, 1662 | "flowAlias": "Account verification options", 1663 | "userSetupAllowed": false, 1664 | "autheticatorFlow": true 1665 | } 1666 | ] 1667 | }, 1668 | { 1669 | "id": "34a42685-cd34-43ec-b107-b09335565b6f", 1670 | "alias": "Reset - Conditional OTP", 1671 | "description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.", 1672 | "providerId": "basic-flow", 1673 | "topLevel": false, 1674 | "builtIn": true, 1675 | "authenticationExecutions": [ 1676 | { 1677 | "authenticator": "conditional-user-configured", 1678 | "authenticatorFlow": false, 1679 | "requirement": "REQUIRED", 1680 | "priority": 10, 1681 | "userSetupAllowed": false, 1682 | "autheticatorFlow": false 1683 | }, 1684 | { 1685 | "authenticator": "reset-otp", 1686 | "authenticatorFlow": false, 1687 | "requirement": "REQUIRED", 1688 | "priority": 20, 1689 | "userSetupAllowed": false, 1690 | "autheticatorFlow": false 1691 | } 1692 | ] 1693 | }, 1694 | { 1695 | "id": "c90a26fa-70b0-4c5a-b970-5114de98862d", 1696 | "alias": "User creation or linking", 1697 | "description": "Flow for the existing/non-existing user alternatives", 1698 | "providerId": "basic-flow", 1699 | "topLevel": false, 1700 | "builtIn": true, 1701 | "authenticationExecutions": [ 1702 | { 1703 | "authenticatorConfig": "create unique user config", 1704 | "authenticator": "idp-create-user-if-unique", 1705 | "authenticatorFlow": false, 1706 | "requirement": "ALTERNATIVE", 1707 | "priority": 10, 1708 | "userSetupAllowed": false, 1709 | "autheticatorFlow": false 1710 | }, 1711 | { 1712 | "authenticatorFlow": true, 1713 | "requirement": "ALTERNATIVE", 1714 | "priority": 20, 1715 | "flowAlias": "Handle Existing Account", 1716 | "userSetupAllowed": false, 1717 | "autheticatorFlow": true 1718 | } 1719 | ] 1720 | }, 1721 | { 1722 | "id": "691afb6a-e789-4c8c-a1da-d023a1143269", 1723 | "alias": "Verify Existing Account by Re-authentication", 1724 | "description": "Reauthentication of existing account", 1725 | "providerId": "basic-flow", 1726 | "topLevel": false, 1727 | "builtIn": true, 1728 | "authenticationExecutions": [ 1729 | { 1730 | "authenticator": "idp-username-password-form", 1731 | "authenticatorFlow": false, 1732 | "requirement": "REQUIRED", 1733 | "priority": 10, 1734 | "userSetupAllowed": false, 1735 | "autheticatorFlow": false 1736 | }, 1737 | { 1738 | "authenticatorFlow": true, 1739 | "requirement": "CONDITIONAL", 1740 | "priority": 20, 1741 | "flowAlias": "First broker login - Conditional OTP", 1742 | "userSetupAllowed": false, 1743 | "autheticatorFlow": true 1744 | } 1745 | ] 1746 | }, 1747 | { 1748 | "id": "015e20b3-0304-4084-bca9-5d2ea4c45c9b", 1749 | "alias": "browser", 1750 | "description": "browser based authentication", 1751 | "providerId": "basic-flow", 1752 | "topLevel": true, 1753 | "builtIn": true, 1754 | "authenticationExecutions": [ 1755 | { 1756 | "authenticator": "auth-cookie", 1757 | "authenticatorFlow": false, 1758 | "requirement": "ALTERNATIVE", 1759 | "priority": 10, 1760 | "userSetupAllowed": false, 1761 | "autheticatorFlow": false 1762 | }, 1763 | { 1764 | "authenticator": "auth-spnego", 1765 | "authenticatorFlow": false, 1766 | "requirement": "DISABLED", 1767 | "priority": 20, 1768 | "userSetupAllowed": false, 1769 | "autheticatorFlow": false 1770 | }, 1771 | { 1772 | "authenticator": "identity-provider-redirector", 1773 | "authenticatorFlow": false, 1774 | "requirement": "ALTERNATIVE", 1775 | "priority": 25, 1776 | "userSetupAllowed": false, 1777 | "autheticatorFlow": false 1778 | }, 1779 | { 1780 | "authenticatorFlow": true, 1781 | "requirement": "ALTERNATIVE", 1782 | "priority": 30, 1783 | "flowAlias": "forms", 1784 | "userSetupAllowed": false, 1785 | "autheticatorFlow": true 1786 | } 1787 | ] 1788 | }, 1789 | { 1790 | "id": "8c9eff2d-928c-43e8-9d26-3dbcb6745bcb", 1791 | "alias": "clients", 1792 | "description": "Base authentication for clients", 1793 | "providerId": "client-flow", 1794 | "topLevel": true, 1795 | "builtIn": true, 1796 | "authenticationExecutions": [ 1797 | { 1798 | "authenticator": "client-secret", 1799 | "authenticatorFlow": false, 1800 | "requirement": "ALTERNATIVE", 1801 | "priority": 10, 1802 | "userSetupAllowed": false, 1803 | "autheticatorFlow": false 1804 | }, 1805 | { 1806 | "authenticator": "client-jwt", 1807 | "authenticatorFlow": false, 1808 | "requirement": "ALTERNATIVE", 1809 | "priority": 20, 1810 | "userSetupAllowed": false, 1811 | "autheticatorFlow": false 1812 | }, 1813 | { 1814 | "authenticator": "client-secret-jwt", 1815 | "authenticatorFlow": false, 1816 | "requirement": "ALTERNATIVE", 1817 | "priority": 30, 1818 | "userSetupAllowed": false, 1819 | "autheticatorFlow": false 1820 | }, 1821 | { 1822 | "authenticator": "client-x509", 1823 | "authenticatorFlow": false, 1824 | "requirement": "ALTERNATIVE", 1825 | "priority": 40, 1826 | "userSetupAllowed": false, 1827 | "autheticatorFlow": false 1828 | } 1829 | ] 1830 | }, 1831 | { 1832 | "id": "2f6e8d5c-75d6-446a-882c-49f2f7e229d2", 1833 | "alias": "direct grant", 1834 | "description": "OpenID Connect Resource Owner Grant", 1835 | "providerId": "basic-flow", 1836 | "topLevel": true, 1837 | "builtIn": true, 1838 | "authenticationExecutions": [ 1839 | { 1840 | "authenticator": "direct-grant-validate-username", 1841 | "authenticatorFlow": false, 1842 | "requirement": "REQUIRED", 1843 | "priority": 10, 1844 | "userSetupAllowed": false, 1845 | "autheticatorFlow": false 1846 | }, 1847 | { 1848 | "authenticator": "direct-grant-validate-password", 1849 | "authenticatorFlow": false, 1850 | "requirement": "REQUIRED", 1851 | "priority": 20, 1852 | "userSetupAllowed": false, 1853 | "autheticatorFlow": false 1854 | }, 1855 | { 1856 | "authenticatorFlow": true, 1857 | "requirement": "CONDITIONAL", 1858 | "priority": 30, 1859 | "flowAlias": "Direct Grant - Conditional OTP", 1860 | "userSetupAllowed": false, 1861 | "autheticatorFlow": true 1862 | } 1863 | ] 1864 | }, 1865 | { 1866 | "id": "36dc19bd-3d73-4bbd-aafa-32c418639a4f", 1867 | "alias": "docker auth", 1868 | "description": "Used by Docker clients to authenticate against the IDP", 1869 | "providerId": "basic-flow", 1870 | "topLevel": true, 1871 | "builtIn": true, 1872 | "authenticationExecutions": [ 1873 | { 1874 | "authenticator": "docker-http-basic-authenticator", 1875 | "authenticatorFlow": false, 1876 | "requirement": "REQUIRED", 1877 | "priority": 10, 1878 | "userSetupAllowed": false, 1879 | "autheticatorFlow": false 1880 | } 1881 | ] 1882 | }, 1883 | { 1884 | "id": "9e8448d4-1603-499c-9b7c-c6d8f32084fa", 1885 | "alias": "first broker login", 1886 | "description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account", 1887 | "providerId": "basic-flow", 1888 | "topLevel": true, 1889 | "builtIn": true, 1890 | "authenticationExecutions": [ 1891 | { 1892 | "authenticatorConfig": "review profile config", 1893 | "authenticator": "idp-review-profile", 1894 | "authenticatorFlow": false, 1895 | "requirement": "REQUIRED", 1896 | "priority": 10, 1897 | "userSetupAllowed": false, 1898 | "autheticatorFlow": false 1899 | }, 1900 | { 1901 | "authenticatorFlow": true, 1902 | "requirement": "REQUIRED", 1903 | "priority": 20, 1904 | "flowAlias": "User creation or linking", 1905 | "userSetupAllowed": false, 1906 | "autheticatorFlow": true 1907 | } 1908 | ] 1909 | }, 1910 | { 1911 | "id": "a57a2191-d45e-4934-9080-5a2b5fafd920", 1912 | "alias": "forms", 1913 | "description": "Username, password, otp and other auth forms.", 1914 | "providerId": "basic-flow", 1915 | "topLevel": false, 1916 | "builtIn": true, 1917 | "authenticationExecutions": [ 1918 | { 1919 | "authenticator": "auth-username-password-form", 1920 | "authenticatorFlow": false, 1921 | "requirement": "REQUIRED", 1922 | "priority": 10, 1923 | "userSetupAllowed": false, 1924 | "autheticatorFlow": false 1925 | }, 1926 | { 1927 | "authenticatorFlow": true, 1928 | "requirement": "CONDITIONAL", 1929 | "priority": 20, 1930 | "flowAlias": "Browser - Conditional OTP", 1931 | "userSetupAllowed": false, 1932 | "autheticatorFlow": true 1933 | } 1934 | ] 1935 | }, 1936 | { 1937 | "id": "b00ed840-69f1-41ce-9ec5-69de2e436c22", 1938 | "alias": "http challenge", 1939 | "description": "An authentication flow based on challenge-response HTTP Authentication Schemes", 1940 | "providerId": "basic-flow", 1941 | "topLevel": true, 1942 | "builtIn": true, 1943 | "authenticationExecutions": [ 1944 | { 1945 | "authenticator": "no-cookie-redirect", 1946 | "authenticatorFlow": false, 1947 | "requirement": "REQUIRED", 1948 | "priority": 10, 1949 | "userSetupAllowed": false, 1950 | "autheticatorFlow": false 1951 | }, 1952 | { 1953 | "authenticatorFlow": true, 1954 | "requirement": "REQUIRED", 1955 | "priority": 20, 1956 | "flowAlias": "Authentication Options", 1957 | "userSetupAllowed": false, 1958 | "autheticatorFlow": true 1959 | } 1960 | ] 1961 | }, 1962 | { 1963 | "id": "3a2db639-fa3d-424f-b998-3d2186db4042", 1964 | "alias": "registration", 1965 | "description": "registration flow", 1966 | "providerId": "basic-flow", 1967 | "topLevel": true, 1968 | "builtIn": true, 1969 | "authenticationExecutions": [ 1970 | { 1971 | "authenticator": "registration-page-form", 1972 | "authenticatorFlow": true, 1973 | "requirement": "REQUIRED", 1974 | "priority": 10, 1975 | "flowAlias": "registration form", 1976 | "userSetupAllowed": false, 1977 | "autheticatorFlow": true 1978 | } 1979 | ] 1980 | }, 1981 | { 1982 | "id": "a8dd7a1d-b055-4835-9bc6-64f39a125bf8", 1983 | "alias": "registration form", 1984 | "description": "registration form", 1985 | "providerId": "form-flow", 1986 | "topLevel": false, 1987 | "builtIn": true, 1988 | "authenticationExecutions": [ 1989 | { 1990 | "authenticator": "registration-user-creation", 1991 | "authenticatorFlow": false, 1992 | "requirement": "REQUIRED", 1993 | "priority": 20, 1994 | "userSetupAllowed": false, 1995 | "autheticatorFlow": false 1996 | }, 1997 | { 1998 | "authenticator": "registration-profile-action", 1999 | "authenticatorFlow": false, 2000 | "requirement": "REQUIRED", 2001 | "priority": 40, 2002 | "userSetupAllowed": false, 2003 | "autheticatorFlow": false 2004 | }, 2005 | { 2006 | "authenticator": "registration-password-action", 2007 | "authenticatorFlow": false, 2008 | "requirement": "REQUIRED", 2009 | "priority": 50, 2010 | "userSetupAllowed": false, 2011 | "autheticatorFlow": false 2012 | }, 2013 | { 2014 | "authenticator": "registration-recaptcha-action", 2015 | "authenticatorFlow": false, 2016 | "requirement": "DISABLED", 2017 | "priority": 60, 2018 | "userSetupAllowed": false, 2019 | "autheticatorFlow": false 2020 | } 2021 | ] 2022 | }, 2023 | { 2024 | "id": "664686af-74a3-46c7-bc40-d08adc5eb6b4", 2025 | "alias": "reset credentials", 2026 | "description": "Reset credentials for a user if they forgot their password or something", 2027 | "providerId": "basic-flow", 2028 | "topLevel": true, 2029 | "builtIn": true, 2030 | "authenticationExecutions": [ 2031 | { 2032 | "authenticator": "reset-credentials-choose-user", 2033 | "authenticatorFlow": false, 2034 | "requirement": "REQUIRED", 2035 | "priority": 10, 2036 | "userSetupAllowed": false, 2037 | "autheticatorFlow": false 2038 | }, 2039 | { 2040 | "authenticator": "reset-credential-email", 2041 | "authenticatorFlow": false, 2042 | "requirement": "REQUIRED", 2043 | "priority": 20, 2044 | "userSetupAllowed": false, 2045 | "autheticatorFlow": false 2046 | }, 2047 | { 2048 | "authenticator": "reset-password", 2049 | "authenticatorFlow": false, 2050 | "requirement": "REQUIRED", 2051 | "priority": 30, 2052 | "userSetupAllowed": false, 2053 | "autheticatorFlow": false 2054 | }, 2055 | { 2056 | "authenticatorFlow": true, 2057 | "requirement": "CONDITIONAL", 2058 | "priority": 40, 2059 | "flowAlias": "Reset - Conditional OTP", 2060 | "userSetupAllowed": false, 2061 | "autheticatorFlow": true 2062 | } 2063 | ] 2064 | }, 2065 | { 2066 | "id": "5528693a-3e05-4073-8696-7a0316a56bc6", 2067 | "alias": "saml ecp", 2068 | "description": "SAML ECP Profile Authentication Flow", 2069 | "providerId": "basic-flow", 2070 | "topLevel": true, 2071 | "builtIn": true, 2072 | "authenticationExecutions": [ 2073 | { 2074 | "authenticator": "http-basic-authenticator", 2075 | "authenticatorFlow": false, 2076 | "requirement": "REQUIRED", 2077 | "priority": 10, 2078 | "userSetupAllowed": false, 2079 | "autheticatorFlow": false 2080 | } 2081 | ] 2082 | } 2083 | ], 2084 | "authenticatorConfig": [ 2085 | { 2086 | "id": "4d310680-8ba1-4169-bae0-bb1752b3c066", 2087 | "alias": "create unique user config", 2088 | "config": { 2089 | "require.password.update.after.registration": "false" 2090 | } 2091 | }, 2092 | { 2093 | "id": "a3f68b84-b089-4c5e-8aa0-81751f99b779", 2094 | "alias": "review profile config", 2095 | "config": { 2096 | "update.profile.on.first.login": "missing" 2097 | } 2098 | } 2099 | ], 2100 | "requiredActions": [ 2101 | { 2102 | "alias": "CONFIGURE_TOTP", 2103 | "name": "Configure OTP", 2104 | "providerId": "CONFIGURE_TOTP", 2105 | "enabled": true, 2106 | "defaultAction": false, 2107 | "priority": 10, 2108 | "config": {} 2109 | }, 2110 | { 2111 | "alias": "terms_and_conditions", 2112 | "name": "Terms and Conditions", 2113 | "providerId": "terms_and_conditions", 2114 | "enabled": false, 2115 | "defaultAction": false, 2116 | "priority": 20, 2117 | "config": {} 2118 | }, 2119 | { 2120 | "alias": "UPDATE_PASSWORD", 2121 | "name": "Update Password", 2122 | "providerId": "UPDATE_PASSWORD", 2123 | "enabled": true, 2124 | "defaultAction": false, 2125 | "priority": 30, 2126 | "config": {} 2127 | }, 2128 | { 2129 | "alias": "UPDATE_PROFILE", 2130 | "name": "Update Profile", 2131 | "providerId": "UPDATE_PROFILE", 2132 | "enabled": true, 2133 | "defaultAction": false, 2134 | "priority": 40, 2135 | "config": {} 2136 | }, 2137 | { 2138 | "alias": "VERIFY_EMAIL", 2139 | "name": "Verify Email", 2140 | "providerId": "VERIFY_EMAIL", 2141 | "enabled": true, 2142 | "defaultAction": false, 2143 | "priority": 50, 2144 | "config": {} 2145 | }, 2146 | { 2147 | "alias": "delete_account", 2148 | "name": "Delete Account", 2149 | "providerId": "delete_account", 2150 | "enabled": false, 2151 | "defaultAction": false, 2152 | "priority": 60, 2153 | "config": {} 2154 | }, 2155 | { 2156 | "alias": "update_user_locale", 2157 | "name": "Update User Locale", 2158 | "providerId": "update_user_locale", 2159 | "enabled": true, 2160 | "defaultAction": false, 2161 | "priority": 1000, 2162 | "config": {} 2163 | } 2164 | ], 2165 | "browserFlow": "browser", 2166 | "registrationFlow": "registration", 2167 | "directGrantFlow": "direct grant", 2168 | "resetCredentialsFlow": "reset credentials", 2169 | "clientAuthenticationFlow": "clients", 2170 | "dockerAuthenticationFlow": "docker auth", 2171 | "attributes": { 2172 | "cibaBackchannelTokenDeliveryMode": "poll", 2173 | "cibaExpiresIn": "120", 2174 | "cibaAuthRequestedUserHint": "login_hint", 2175 | "oauth2DeviceCodeLifespan": "600", 2176 | "oauth2DevicePollingInterval": "5", 2177 | "clientOfflineSessionMaxLifespan": "0", 2178 | "clientSessionIdleTimeout": "0", 2179 | "userProfileEnabled": "false", 2180 | "clientSessionMaxLifespan": "0", 2181 | "parRequestUriLifespan": "60", 2182 | "clientOfflineSessionIdleTimeout": "0", 2183 | "cibaInterval": "5" 2184 | }, 2185 | "keycloakVersion": "15.0.2", 2186 | "userManagedAccessAllowed": false, 2187 | "clientProfiles": { 2188 | "profiles": [] 2189 | }, 2190 | "clientPolicies": { 2191 | "policies": [] 2192 | } 2193 | } --------------------------------------------------------------------------------