Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. Keycloak Provider
  3. API Docs
  4. Realm
Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
pulumi/pulumi-keycloak

keycloak.Realm

Explore with Pulumi AI

keycloak logo
Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
pulumi/pulumi-keycloak

    Allows for creating and managing Realms within Keycloak.

    A realm manages a logical collection of users, credentials, roles, and groups. Users log in to realms and can be federated from multiple sources.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";

const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
    displayName: "my realm",
    displayNameHtml: "<b>my realm</b>",
    loginTheme: "base",
    accessCodeLifespan: "1h",
    sslRequired: "external",
    passwordPolicy: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
    attributes: {
        mycustomAttribute: "myCustomValue",
    },
    smtpServer: {
        host: "smtp.example.com",
        from: "example@example.com",
        auth: {
            username: "tom",
            password: "password",
        },
    },
    internationalization: {
        supportedLocales: [
            "en",
            "de",
            "es",
        ],
        defaultLocale: "en",
    },
    securityDefenses: {
        headers: {
            xFrameOptions: "DENY",
            contentSecurityPolicy: "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
            contentSecurityPolicyReportOnly: "",
            xContentTypeOptions: "nosniff",
            xRobotsTag: "none",
            xXssProtection: "1; mode=block",
            strictTransportSecurity: "max-age=31536000; includeSubDomains",
        },
        bruteForceDetection: {
            permanentLockout: false,
            maxLoginFailures: 30,
            waitIncrementSeconds: 60,
            quickLoginCheckMilliSeconds: 1000,
            minimumQuickLoginWaitSeconds: 60,
            maxFailureWaitSeconds: 900,
            failureResetTimeSeconds: 43200,
        },
    },
    webAuthnPolicy: {
        relyingPartyEntityName: "Example",
        relyingPartyId: "keycloak.example.com",
        signatureAlgorithms: [
            "ES256",
            "RS256",
        ],
    },
});

    import pulumi
import pulumi_keycloak as keycloak

realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True,
    display_name="my realm",
    display_name_html="<b>my realm</b>",
    login_theme="base",
    access_code_lifespan="1h",
    ssl_required="external",
    password_policy="upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
    attributes={
        "mycustomAttribute": "myCustomValue",
    },
    smtp_server={
        "host": "smtp.example.com",
        "from_": "example@example.com",
        "auth": {
            "username": "tom",
            "password": "password",
        },
    },
    internationalization={
        "supported_locales": [
            "en",
            "de",
            "es",
        ],
        "default_locale": "en",
    },
    security_defenses={
        "headers": {
            "x_frame_options": "DENY",
            "content_security_policy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
            "content_security_policy_report_only": "",
            "x_content_type_options": "nosniff",
            "x_robots_tag": "none",
            "x_xss_protection": "1; mode=block",
            "strict_transport_security": "max-age=31536000; includeSubDomains",
        },
        "brute_force_detection": {
            "permanent_lockout": False,
            "max_login_failures": 30,
            "wait_increment_seconds": 60,
            "quick_login_check_milli_seconds": 1000,
            "minimum_quick_login_wait_seconds": 60,
            "max_failure_wait_seconds": 900,
            "failure_reset_time_seconds": 43200,
        },
    },
    web_authn_policy={
        "relying_party_entity_name": "Example",
        "relying_party_id": "keycloak.example.com",
        "signature_algorithms": [
            "ES256",
            "RS256",
        ],
    })

    package main

import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:              pulumi.String("my-realm"),
			Enabled:            pulumi.Bool(true),
			DisplayName:        pulumi.String("my realm"),
			DisplayNameHtml:    pulumi.String("<b>my realm</b>"),
			LoginTheme:         pulumi.String("base"),
			AccessCodeLifespan: pulumi.String("1h"),
			SslRequired:        pulumi.String("external"),
			PasswordPolicy:     pulumi.String("upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername"),
			Attributes: pulumi.StringMap{
				"mycustomAttribute": pulumi.String("myCustomValue"),
			},
			SmtpServer: &keycloak.RealmSmtpServerArgs{
				Host: pulumi.String("smtp.example.com"),
				From: pulumi.String("example@example.com"),
				Auth: &keycloak.RealmSmtpServerAuthArgs{
					Username: pulumi.String("tom"),
					Password: pulumi.String("password"),
				},
			},
			Internationalization: &keycloak.RealmInternationalizationArgs{
				SupportedLocales: pulumi.StringArray{
					pulumi.String("en"),
					pulumi.String("de"),
					pulumi.String("es"),
				},
				DefaultLocale: pulumi.String("en"),
			},
			SecurityDefenses: &keycloak.RealmSecurityDefensesArgs{
				Headers: &keycloak.RealmSecurityDefensesHeadersArgs{
					XFrameOptions:                   pulumi.String("DENY"),
					ContentSecurityPolicy:           pulumi.String("frame-src 'self'; frame-ancestors 'self'; object-src 'none';"),
					ContentSecurityPolicyReportOnly: pulumi.String(""),
					XContentTypeOptions:             pulumi.String("nosniff"),
					XRobotsTag:                      pulumi.String("none"),
					XXssProtection:                  pulumi.String("1; mode=block"),
					StrictTransportSecurity:         pulumi.String("max-age=31536000; includeSubDomains"),
				},
				BruteForceDetection: &keycloak.RealmSecurityDefensesBruteForceDetectionArgs{
					PermanentLockout:             pulumi.Bool(false),
					MaxLoginFailures:             pulumi.Int(30),
					WaitIncrementSeconds:         pulumi.Int(60),
					QuickLoginCheckMilliSeconds:  pulumi.Int(1000),
					MinimumQuickLoginWaitSeconds: pulumi.Int(60),
					MaxFailureWaitSeconds:        pulumi.Int(900),
					FailureResetTimeSeconds:      pulumi.Int(43200),
				},
			},
			WebAuthnPolicy: &keycloak.RealmWebAuthnPolicyArgs{
				RelyingPartyEntityName: pulumi.String("Example"),
				RelyingPartyId:         pulumi.String("keycloak.example.com"),
				SignatureAlgorithms: pulumi.StringArray{
					pulumi.String("ES256"),
					pulumi.String("RS256"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;

return await Deployment.RunAsync(() => 
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
        DisplayName = "my realm",
        DisplayNameHtml = "<b>my realm</b>",
        LoginTheme = "base",
        AccessCodeLifespan = "1h",
        SslRequired = "external",
        PasswordPolicy = "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
        Attributes = 
        {
            { "mycustomAttribute", "myCustomValue" },
        },
        SmtpServer = new Keycloak.Inputs.RealmSmtpServerArgs
        {
            Host = "smtp.example.com",
            From = "example@example.com",
            Auth = new Keycloak.Inputs.RealmSmtpServerAuthArgs
            {
                Username = "tom",
                Password = "password",
            },
        },
        Internationalization = new Keycloak.Inputs.RealmInternationalizationArgs
        {
            SupportedLocales = new[]
            {
                "en",
                "de",
                "es",
            },
            DefaultLocale = "en",
        },
        SecurityDefenses = new Keycloak.Inputs.RealmSecurityDefensesArgs
        {
            Headers = new Keycloak.Inputs.RealmSecurityDefensesHeadersArgs
            {
                XFrameOptions = "DENY",
                ContentSecurityPolicy = "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
                ContentSecurityPolicyReportOnly = "",
                XContentTypeOptions = "nosniff",
                XRobotsTag = "none",
                XXssProtection = "1; mode=block",
                StrictTransportSecurity = "max-age=31536000; includeSubDomains",
            },
            BruteForceDetection = new Keycloak.Inputs.RealmSecurityDefensesBruteForceDetectionArgs
            {
                PermanentLockout = false,
                MaxLoginFailures = 30,
                WaitIncrementSeconds = 60,
                QuickLoginCheckMilliSeconds = 1000,
                MinimumQuickLoginWaitSeconds = 60,
                MaxFailureWaitSeconds = 900,
                FailureResetTimeSeconds = 43200,
            },
        },
        WebAuthnPolicy = new Keycloak.Inputs.RealmWebAuthnPolicyArgs
        {
            RelyingPartyEntityName = "Example",
            RelyingPartyId = "keycloak.example.com",
            SignatureAlgorithms = new[]
            {
                "ES256",
                "RS256",
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.inputs.RealmSmtpServerArgs;
import com.pulumi.keycloak.inputs.RealmSmtpServerAuthArgs;
import com.pulumi.keycloak.inputs.RealmInternationalizationArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesHeadersArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesBruteForceDetectionArgs;
import com.pulumi.keycloak.inputs.RealmWebAuthnPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .displayName("my realm")
            .displayNameHtml("<b>my realm</b>")
            .loginTheme("base")
            .accessCodeLifespan("1h")
            .sslRequired("external")
            .passwordPolicy("upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername")
            .attributes(Map.of("mycustomAttribute", "myCustomValue"))
            .smtpServer(RealmSmtpServerArgs.builder()
                .host("smtp.example.com")
                .from("example@example.com")
                .auth(RealmSmtpServerAuthArgs.builder()
                    .username("tom")
                    .password("password")
                    .build())
                .build())
            .internationalization(RealmInternationalizationArgs.builder()
                .supportedLocales(                
                    "en",
                    "de",
                    "es")
                .defaultLocale("en")
                .build())
            .securityDefenses(RealmSecurityDefensesArgs.builder()
                .headers(RealmSecurityDefensesHeadersArgs.builder()
                    .xFrameOptions("DENY")
                    .contentSecurityPolicy("frame-src 'self'; frame-ancestors 'self'; object-src 'none';")
                    .contentSecurityPolicyReportOnly("")
                    .xContentTypeOptions("nosniff")
                    .xRobotsTag("none")
                    .xXssProtection("1; mode=block")
                    .strictTransportSecurity("max-age=31536000; includeSubDomains")
                    .build())
                .bruteForceDetection(RealmSecurityDefensesBruteForceDetectionArgs.builder()
                    .permanentLockout(false)
                    .maxLoginFailures(30)
                    .waitIncrementSeconds(60)
                    .quickLoginCheckMilliSeconds(1000)
                    .minimumQuickLoginWaitSeconds(60)
                    .maxFailureWaitSeconds(900)
                    .failureResetTimeSeconds(43200)
                    .build())
                .build())
            .webAuthnPolicy(RealmWebAuthnPolicyArgs.builder()
                .relyingPartyEntityName("Example")
                .relyingPartyId("keycloak.example.com")
                .signatureAlgorithms(                
                    "ES256",
                    "RS256")
                .build())
            .build());

    }
}

    resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
      displayName: my realm
      displayNameHtml: <b>my realm</b>
      loginTheme: base
      accessCodeLifespan: 1h
      sslRequired: external
      passwordPolicy: upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername
      attributes:
        mycustomAttribute: myCustomValue
      smtpServer:
        host: smtp.example.com
        from: example@example.com
        auth:
          username: tom
          password: password
      internationalization:
        supportedLocales:
          - en
          - de
          - es
        defaultLocale: en
      securityDefenses:
        headers:
          xFrameOptions: DENY
          contentSecurityPolicy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
          contentSecurityPolicyReportOnly: ""
          xContentTypeOptions: nosniff
          xRobotsTag: none
          xXssProtection: 1; mode=block
          strictTransportSecurity: max-age=31536000; includeSubDomains
        bruteForceDetection:
          permanentLockout: false
          maxLoginFailures: 30
          waitIncrementSeconds: 60
          quickLoginCheckMilliSeconds: 1000
          minimumQuickLoginWaitSeconds: 60
          maxFailureWaitSeconds: 900
          failureResetTimeSeconds: 43200
      webAuthnPolicy:
        relyingPartyEntityName: Example
        relyingPartyId: keycloak.example.com
        signatureAlgorithms:
          - ES256
          - RS256

    Default Client Scopes

    • default_default_client_scopes - (Optional) A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak’s built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_default_client_scopes.
    • default_optional_client_scopes - (Optional) A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak’s built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak_realm_optional_client_scopes.

    Create Realm Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Realm(name: string, args: RealmArgs, opts?: CustomResourceOptions);
    @overload
def Realm(resource_name: str,
          args: RealmArgs,
          opts: Optional[ResourceOptions] = None)

@overload
def Realm(resource_name: str,
          opts: Optional[ResourceOptions] = None,
          realm: Optional[str] = None,
          access_code_lifespan: Optional[str] = None,
          access_code_lifespan_login: Optional[str] = None,
          access_code_lifespan_user_action: Optional[str] = None,
          access_token_lifespan: Optional[str] = None,
          access_token_lifespan_for_implicit_flow: Optional[str] = None,
          account_theme: Optional[str] = None,
          action_token_generated_by_admin_lifespan: Optional[str] = None,
          action_token_generated_by_user_lifespan: Optional[str] = None,
          admin_theme: Optional[str] = None,
          attributes: Optional[Mapping[str, str]] = None,
          browser_flow: Optional[str] = None,
          client_authentication_flow: Optional[str] = None,
          client_session_idle_timeout: Optional[str] = None,
          client_session_max_lifespan: Optional[str] = None,
          default_default_client_scopes: Optional[Sequence[str]] = None,
          default_optional_client_scopes: Optional[Sequence[str]] = None,
          default_signature_algorithm: Optional[str] = None,
          direct_grant_flow: Optional[str] = None,
          display_name: Optional[str] = None,
          display_name_html: Optional[str] = None,
          docker_authentication_flow: Optional[str] = None,
          duplicate_emails_allowed: Optional[bool] = None,
          edit_username_allowed: Optional[bool] = None,
          email_theme: Optional[str] = None,
          enabled: Optional[bool] = None,
          internal_id: Optional[str] = None,
          internationalization: Optional[RealmInternationalizationArgs] = None,
          login_theme: Optional[str] = None,
          login_with_email_allowed: Optional[bool] = None,
          oauth2_device_code_lifespan: Optional[str] = None,
          oauth2_device_polling_interval: Optional[int] = None,
          offline_session_idle_timeout: Optional[str] = None,
          offline_session_max_lifespan: Optional[str] = None,
          offline_session_max_lifespan_enabled: Optional[bool] = None,
          otp_policy: Optional[RealmOtpPolicyArgs] = None,
          password_policy: Optional[str] = None,
          refresh_token_max_reuse: Optional[int] = None,
          registration_allowed: Optional[bool] = None,
          registration_email_as_username: Optional[bool] = None,
          registration_flow: Optional[str] = None,
          remember_me: Optional[bool] = None,
          reset_credentials_flow: Optional[str] = None,
          reset_password_allowed: Optional[bool] = None,
          revoke_refresh_token: Optional[bool] = None,
          security_defenses: Optional[RealmSecurityDefensesArgs] = None,
          smtp_server: Optional[RealmSmtpServerArgs] = None,
          ssl_required: Optional[str] = None,
          sso_session_idle_timeout: Optional[str] = None,
          sso_session_idle_timeout_remember_me: Optional[str] = None,
          sso_session_max_lifespan: Optional[str] = None,
          sso_session_max_lifespan_remember_me: Optional[str] = None,
          user_managed_access: Optional[bool] = None,
          verify_email: Optional[bool] = None,
          web_authn_passwordless_policy: Optional[RealmWebAuthnPasswordlessPolicyArgs] = None,
          web_authn_policy: Optional[RealmWebAuthnPolicyArgs] = None)
    func NewRealm(ctx *Context, name string, args RealmArgs, opts ...ResourceOption) (*Realm, error)
    public Realm(string name, RealmArgs args, CustomResourceOptions? opts = null)
    public Realm(String name, RealmArgs args)
public Realm(String name, RealmArgs args, CustomResourceOptions options)

    type: keycloak:Realm
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args RealmArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RealmArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RealmArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RealmArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RealmArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var realmResource = new Keycloak.Realm("realmResource", new()
{
    RealmName = "string",
    AccessCodeLifespan = "string",
    AccessCodeLifespanLogin = "string",
    AccessCodeLifespanUserAction = "string",
    AccessTokenLifespan = "string",
    AccessTokenLifespanForImplicitFlow = "string",
    AccountTheme = "string",
    ActionTokenGeneratedByAdminLifespan = "string",
    ActionTokenGeneratedByUserLifespan = "string",
    AdminTheme = "string",
    Attributes = 
    {
        { "string", "string" },
    },
    BrowserFlow = "string",
    ClientAuthenticationFlow = "string",
    ClientSessionIdleTimeout = "string",
    ClientSessionMaxLifespan = "string",
    DefaultDefaultClientScopes = new[]
    {
        "string",
    },
    DefaultOptionalClientScopes = new[]
    {
        "string",
    },
    DefaultSignatureAlgorithm = "string",
    DirectGrantFlow = "string",
    DisplayName = "string",
    DisplayNameHtml = "string",
    DockerAuthenticationFlow = "string",
    DuplicateEmailsAllowed = false,
    EditUsernameAllowed = false,
    EmailTheme = "string",
    Enabled = false,
    InternalId = "string",
    Internationalization = new Keycloak.Inputs.RealmInternationalizationArgs
    {
        DefaultLocale = "string",
        SupportedLocales = new[]
        {
            "string",
        },
    },
    LoginTheme = "string",
    LoginWithEmailAllowed = false,
    Oauth2DeviceCodeLifespan = "string",
    Oauth2DevicePollingInterval = 0,
    OfflineSessionIdleTimeout = "string",
    OfflineSessionMaxLifespan = "string",
    OfflineSessionMaxLifespanEnabled = false,
    OtpPolicy = new Keycloak.Inputs.RealmOtpPolicyArgs
    {
        Algorithm = "string",
        Digits = 0,
        InitialCounter = 0,
        LookAheadWindow = 0,
        Period = 0,
        Type = "string",
    },
    PasswordPolicy = "string",
    RefreshTokenMaxReuse = 0,
    RegistrationAllowed = false,
    RegistrationEmailAsUsername = false,
    RegistrationFlow = "string",
    RememberMe = false,
    ResetCredentialsFlow = "string",
    ResetPasswordAllowed = false,
    RevokeRefreshToken = false,
    SecurityDefenses = new Keycloak.Inputs.RealmSecurityDefensesArgs
    {
        BruteForceDetection = new Keycloak.Inputs.RealmSecurityDefensesBruteForceDetectionArgs
        {
            FailureResetTimeSeconds = 0,
            MaxFailureWaitSeconds = 0,
            MaxLoginFailures = 0,
            MinimumQuickLoginWaitSeconds = 0,
            PermanentLockout = false,
            QuickLoginCheckMilliSeconds = 0,
            WaitIncrementSeconds = 0,
        },
        Headers = new Keycloak.Inputs.RealmSecurityDefensesHeadersArgs
        {
            ContentSecurityPolicy = "string",
            ContentSecurityPolicyReportOnly = "string",
            ReferrerPolicy = "string",
            StrictTransportSecurity = "string",
            XContentTypeOptions = "string",
            XFrameOptions = "string",
            XRobotsTag = "string",
            XXssProtection = "string",
        },
    },
    SmtpServer = new Keycloak.Inputs.RealmSmtpServerArgs
    {
        From = "string",
        Host = "string",
        Auth = new Keycloak.Inputs.RealmSmtpServerAuthArgs
        {
            Password = "string",
            Username = "string",
        },
        EnvelopeFrom = "string",
        FromDisplayName = "string",
        Port = "string",
        ReplyTo = "string",
        ReplyToDisplayName = "string",
        Ssl = false,
        Starttls = false,
    },
    SslRequired = "string",
    SsoSessionIdleTimeout = "string",
    SsoSessionIdleTimeoutRememberMe = "string",
    SsoSessionMaxLifespan = "string",
    SsoSessionMaxLifespanRememberMe = "string",
    UserManagedAccess = false,
    VerifyEmail = false,
    WebAuthnPasswordlessPolicy = new Keycloak.Inputs.RealmWebAuthnPasswordlessPolicyArgs
    {
        AcceptableAaguids = new[]
        {
            "string",
        },
        AttestationConveyancePreference = "string",
        AuthenticatorAttachment = "string",
        AvoidSameAuthenticatorRegister = false,
        CreateTimeout = 0,
        RelyingPartyEntityName = "string",
        RelyingPartyId = "string",
        RequireResidentKey = "string",
        SignatureAlgorithms = new[]
        {
            "string",
        },
        UserVerificationRequirement = "string",
    },
    WebAuthnPolicy = new Keycloak.Inputs.RealmWebAuthnPolicyArgs
    {
        AcceptableAaguids = new[]
        {
            "string",
        },
        AttestationConveyancePreference = "string",
        AuthenticatorAttachment = "string",
        AvoidSameAuthenticatorRegister = false,
        CreateTimeout = 0,
        RelyingPartyEntityName = "string",
        RelyingPartyId = "string",
        RequireResidentKey = "string",
        SignatureAlgorithms = new[]
        {
            "string",
        },
        UserVerificationRequirement = "string",
    },
});

    example, err := keycloak.NewRealm(ctx, "realmResource", &keycloak.RealmArgs{
	Realm:                               pulumi.String("string"),
	AccessCodeLifespan:                  pulumi.String("string"),
	AccessCodeLifespanLogin:             pulumi.String("string"),
	AccessCodeLifespanUserAction:        pulumi.String("string"),
	AccessTokenLifespan:                 pulumi.String("string"),
	AccessTokenLifespanForImplicitFlow:  pulumi.String("string"),
	AccountTheme:                        pulumi.String("string"),
	ActionTokenGeneratedByAdminLifespan: pulumi.String("string"),
	ActionTokenGeneratedByUserLifespan:  pulumi.String("string"),
	AdminTheme:                          pulumi.String("string"),
	Attributes: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	BrowserFlow:              pulumi.String("string"),
	ClientAuthenticationFlow: pulumi.String("string"),
	ClientSessionIdleTimeout: pulumi.String("string"),
	ClientSessionMaxLifespan: pulumi.String("string"),
	DefaultDefaultClientScopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DefaultOptionalClientScopes: pulumi.StringArray{
		pulumi.String("string"),
	},
	DefaultSignatureAlgorithm: pulumi.String("string"),
	DirectGrantFlow:           pulumi.String("string"),
	DisplayName:               pulumi.String("string"),
	DisplayNameHtml:           pulumi.String("string"),
	DockerAuthenticationFlow:  pulumi.String("string"),
	DuplicateEmailsAllowed:    pulumi.Bool(false),
	EditUsernameAllowed:       pulumi.Bool(false),
	EmailTheme:                pulumi.String("string"),
	Enabled:                   pulumi.Bool(false),
	InternalId:                pulumi.String("string"),
	Internationalization: &keycloak.RealmInternationalizationArgs{
		DefaultLocale: pulumi.String("string"),
		SupportedLocales: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	LoginTheme:                       pulumi.String("string"),
	LoginWithEmailAllowed:            pulumi.Bool(false),
	Oauth2DeviceCodeLifespan:         pulumi.String("string"),
	Oauth2DevicePollingInterval:      pulumi.Int(0),
	OfflineSessionIdleTimeout:        pulumi.String("string"),
	OfflineSessionMaxLifespan:        pulumi.String("string"),
	OfflineSessionMaxLifespanEnabled: pulumi.Bool(false),
	OtpPolicy: &keycloak.RealmOtpPolicyArgs{
		Algorithm:       pulumi.String("string"),
		Digits:          pulumi.Int(0),
		InitialCounter:  pulumi.Int(0),
		LookAheadWindow: pulumi.Int(0),
		Period:          pulumi.Int(0),
		Type:            pulumi.String("string"),
	},
	PasswordPolicy:              pulumi.String("string"),
	RefreshTokenMaxReuse:        pulumi.Int(0),
	RegistrationAllowed:         pulumi.Bool(false),
	RegistrationEmailAsUsername: pulumi.Bool(false),
	RegistrationFlow:            pulumi.String("string"),
	RememberMe:                  pulumi.Bool(false),
	ResetCredentialsFlow:        pulumi.String("string"),
	ResetPasswordAllowed:        pulumi.Bool(false),
	RevokeRefreshToken:          pulumi.Bool(false),
	SecurityDefenses: &keycloak.RealmSecurityDefensesArgs{
		BruteForceDetection: &keycloak.RealmSecurityDefensesBruteForceDetectionArgs{
			FailureResetTimeSeconds:      pulumi.Int(0),
			MaxFailureWaitSeconds:        pulumi.Int(0),
			MaxLoginFailures:             pulumi.Int(0),
			MinimumQuickLoginWaitSeconds: pulumi.Int(0),
			PermanentLockout:             pulumi.Bool(false),
			QuickLoginCheckMilliSeconds:  pulumi.Int(0),
			WaitIncrementSeconds:         pulumi.Int(0),
		},
		Headers: &keycloak.RealmSecurityDefensesHeadersArgs{
			ContentSecurityPolicy:           pulumi.String("string"),
			ContentSecurityPolicyReportOnly: pulumi.String("string"),
			ReferrerPolicy:                  pulumi.String("string"),
			StrictTransportSecurity:         pulumi.String("string"),
			XContentTypeOptions:             pulumi.String("string"),
			XFrameOptions:                   pulumi.String("string"),
			XRobotsTag:                      pulumi.String("string"),
			XXssProtection:                  pulumi.String("string"),
		},
	},
	SmtpServer: &keycloak.RealmSmtpServerArgs{
		From: pulumi.String("string"),
		Host: pulumi.String("string"),
		Auth: &keycloak.RealmSmtpServerAuthArgs{
			Password: pulumi.String("string"),
			Username: pulumi.String("string"),
		},
		EnvelopeFrom:       pulumi.String("string"),
		FromDisplayName:    pulumi.String("string"),
		Port:               pulumi.String("string"),
		ReplyTo:            pulumi.String("string"),
		ReplyToDisplayName: pulumi.String("string"),
		Ssl:                pulumi.Bool(false),
		Starttls:           pulumi.Bool(false),
	},
	SslRequired:                     pulumi.String("string"),
	SsoSessionIdleTimeout:           pulumi.String("string"),
	SsoSessionIdleTimeoutRememberMe: pulumi.String("string"),
	SsoSessionMaxLifespan:           pulumi.String("string"),
	SsoSessionMaxLifespanRememberMe: pulumi.String("string"),
	UserManagedAccess:               pulumi.Bool(false),
	VerifyEmail:                     pulumi.Bool(false),
	WebAuthnPasswordlessPolicy: &keycloak.RealmWebAuthnPasswordlessPolicyArgs{
		AcceptableAaguids: pulumi.StringArray{
			pulumi.String("string"),
		},
		AttestationConveyancePreference: pulumi.String("string"),
		AuthenticatorAttachment:         pulumi.String("string"),
		AvoidSameAuthenticatorRegister:  pulumi.Bool(false),
		CreateTimeout:                   pulumi.Int(0),
		RelyingPartyEntityName:          pulumi.String("string"),
		RelyingPartyId:                  pulumi.String("string"),
		RequireResidentKey:              pulumi.String("string"),
		SignatureAlgorithms: pulumi.StringArray{
			pulumi.String("string"),
		},
		UserVerificationRequirement: pulumi.String("string"),
	},
	WebAuthnPolicy: &keycloak.RealmWebAuthnPolicyArgs{
		AcceptableAaguids: pulumi.StringArray{
			pulumi.String("string"),
		},
		AttestationConveyancePreference: pulumi.String("string"),
		AuthenticatorAttachment:         pulumi.String("string"),
		AvoidSameAuthenticatorRegister:  pulumi.Bool(false),
		CreateTimeout:                   pulumi.Int(0),
		RelyingPartyEntityName:          pulumi.String("string"),
		RelyingPartyId:                  pulumi.String("string"),
		RequireResidentKey:              pulumi.String("string"),
		SignatureAlgorithms: pulumi.StringArray{
			pulumi.String("string"),
		},
		UserVerificationRequirement: pulumi.String("string"),
	},
})

    var realmResource = new Realm("realmResource", RealmArgs.builder()
    .realm("string")
    .accessCodeLifespan("string")
    .accessCodeLifespanLogin("string")
    .accessCodeLifespanUserAction("string")
    .accessTokenLifespan("string")
    .accessTokenLifespanForImplicitFlow("string")
    .accountTheme("string")
    .actionTokenGeneratedByAdminLifespan("string")
    .actionTokenGeneratedByUserLifespan("string")
    .adminTheme("string")
    .attributes(Map.of("string", "string"))
    .browserFlow("string")
    .clientAuthenticationFlow("string")
    .clientSessionIdleTimeout("string")
    .clientSessionMaxLifespan("string")
    .defaultDefaultClientScopes("string")
    .defaultOptionalClientScopes("string")
    .defaultSignatureAlgorithm("string")
    .directGrantFlow("string")
    .displayName("string")
    .displayNameHtml("string")
    .dockerAuthenticationFlow("string")
    .duplicateEmailsAllowed(false)
    .editUsernameAllowed(false)
    .emailTheme("string")
    .enabled(false)
    .internalId("string")
    .internationalization(RealmInternationalizationArgs.builder()
        .defaultLocale("string")
        .supportedLocales("string")
        .build())
    .loginTheme("string")
    .loginWithEmailAllowed(false)
    .oauth2DeviceCodeLifespan("string")
    .oauth2DevicePollingInterval(0)
    .offlineSessionIdleTimeout("string")
    .offlineSessionMaxLifespan("string")
    .offlineSessionMaxLifespanEnabled(false)
    .otpPolicy(RealmOtpPolicyArgs.builder()
        .algorithm("string")
        .digits(0)
        .initialCounter(0)
        .lookAheadWindow(0)
        .period(0)
        .type("string")
        .build())
    .passwordPolicy("string")
    .refreshTokenMaxReuse(0)
    .registrationAllowed(false)
    .registrationEmailAsUsername(false)
    .registrationFlow("string")
    .rememberMe(false)
    .resetCredentialsFlow("string")
    .resetPasswordAllowed(false)
    .revokeRefreshToken(false)
    .securityDefenses(RealmSecurityDefensesArgs.builder()
        .bruteForceDetection(RealmSecurityDefensesBruteForceDetectionArgs.builder()
            .failureResetTimeSeconds(0)
            .maxFailureWaitSeconds(0)
            .maxLoginFailures(0)
            .minimumQuickLoginWaitSeconds(0)
            .permanentLockout(false)
            .quickLoginCheckMilliSeconds(0)
            .waitIncrementSeconds(0)
            .build())
        .headers(RealmSecurityDefensesHeadersArgs.builder()
            .contentSecurityPolicy("string")
            .contentSecurityPolicyReportOnly("string")
            .referrerPolicy("string")
            .strictTransportSecurity("string")
            .xContentTypeOptions("string")
            .xFrameOptions("string")
            .xRobotsTag("string")
            .xXssProtection("string")
            .build())
        .build())
    .smtpServer(RealmSmtpServerArgs.builder()
        .from("string")
        .host("string")
        .auth(RealmSmtpServerAuthArgs.builder()
            .password("string")
            .username("string")
            .build())
        .envelopeFrom("string")
        .fromDisplayName("string")
        .port("string")
        .replyTo("string")
        .replyToDisplayName("string")
        .ssl(false)
        .starttls(false)
        .build())
    .sslRequired("string")
    .ssoSessionIdleTimeout("string")
    .ssoSessionIdleTimeoutRememberMe("string")
    .ssoSessionMaxLifespan("string")
    .ssoSessionMaxLifespanRememberMe("string")
    .userManagedAccess(false)
    .verifyEmail(false)
    .webAuthnPasswordlessPolicy(RealmWebAuthnPasswordlessPolicyArgs.builder()
        .acceptableAaguids("string")
        .attestationConveyancePreference("string")
        .authenticatorAttachment("string")
        .avoidSameAuthenticatorRegister(false)
        .createTimeout(0)
        .relyingPartyEntityName("string")
        .relyingPartyId("string")
        .requireResidentKey("string")
        .signatureAlgorithms("string")
        .userVerificationRequirement("string")
        .build())
    .webAuthnPolicy(RealmWebAuthnPolicyArgs.builder()
        .acceptableAaguids("string")
        .attestationConveyancePreference("string")
        .authenticatorAttachment("string")
        .avoidSameAuthenticatorRegister(false)
        .createTimeout(0)
        .relyingPartyEntityName("string")
        .relyingPartyId("string")
        .requireResidentKey("string")
        .signatureAlgorithms("string")
        .userVerificationRequirement("string")
        .build())
    .build());

    realm_resource = keycloak.Realm("realmResource",
    realm="string",
    access_code_lifespan="string",
    access_code_lifespan_login="string",
    access_code_lifespan_user_action="string",
    access_token_lifespan="string",
    access_token_lifespan_for_implicit_flow="string",
    account_theme="string",
    action_token_generated_by_admin_lifespan="string",
    action_token_generated_by_user_lifespan="string",
    admin_theme="string",
    attributes={
        "string": "string",
    },
    browser_flow="string",
    client_authentication_flow="string",
    client_session_idle_timeout="string",
    client_session_max_lifespan="string",
    default_default_client_scopes=["string"],
    default_optional_client_scopes=["string"],
    default_signature_algorithm="string",
    direct_grant_flow="string",
    display_name="string",
    display_name_html="string",
    docker_authentication_flow="string",
    duplicate_emails_allowed=False,
    edit_username_allowed=False,
    email_theme="string",
    enabled=False,
    internal_id="string",
    internationalization={
        "default_locale": "string",
        "supported_locales": ["string"],
    },
    login_theme="string",
    login_with_email_allowed=False,
    oauth2_device_code_lifespan="string",
    oauth2_device_polling_interval=0,
    offline_session_idle_timeout="string",
    offline_session_max_lifespan="string",
    offline_session_max_lifespan_enabled=False,
    otp_policy={
        "algorithm": "string",
        "digits": 0,
        "initial_counter": 0,
        "look_ahead_window": 0,
        "period": 0,
        "type": "string",
    },
    password_policy="string",
    refresh_token_max_reuse=0,
    registration_allowed=False,
    registration_email_as_username=False,
    registration_flow="string",
    remember_me=False,
    reset_credentials_flow="string",
    reset_password_allowed=False,
    revoke_refresh_token=False,
    security_defenses={
        "brute_force_detection": {
            "failure_reset_time_seconds": 0,
            "max_failure_wait_seconds": 0,
            "max_login_failures": 0,
            "minimum_quick_login_wait_seconds": 0,
            "permanent_lockout": False,
            "quick_login_check_milli_seconds": 0,
            "wait_increment_seconds": 0,
        },
        "headers": {
            "content_security_policy": "string",
            "content_security_policy_report_only": "string",
            "referrer_policy": "string",
            "strict_transport_security": "string",
            "x_content_type_options": "string",
            "x_frame_options": "string",
            "x_robots_tag": "string",
            "x_xss_protection": "string",
        },
    },
    smtp_server={
        "from_": "string",
        "host": "string",
        "auth": {
            "password": "string",
            "username": "string",
        },
        "envelope_from": "string",
        "from_display_name": "string",
        "port": "string",
        "reply_to": "string",
        "reply_to_display_name": "string",
        "ssl": False,
        "starttls": False,
    },
    ssl_required="string",
    sso_session_idle_timeout="string",
    sso_session_idle_timeout_remember_me="string",
    sso_session_max_lifespan="string",
    sso_session_max_lifespan_remember_me="string",
    user_managed_access=False,
    verify_email=False,
    web_authn_passwordless_policy={
        "acceptable_aaguids": ["string"],
        "attestation_conveyance_preference": "string",
        "authenticator_attachment": "string",
        "avoid_same_authenticator_register": False,
        "create_timeout": 0,
        "relying_party_entity_name": "string",
        "relying_party_id": "string",
        "require_resident_key": "string",
        "signature_algorithms": ["string"],
        "user_verification_requirement": "string",
    },
    web_authn_policy={
        "acceptable_aaguids": ["string"],
        "attestation_conveyance_preference": "string",
        "authenticator_attachment": "string",
        "avoid_same_authenticator_register": False,
        "create_timeout": 0,
        "relying_party_entity_name": "string",
        "relying_party_id": "string",
        "require_resident_key": "string",
        "signature_algorithms": ["string"],
        "user_verification_requirement": "string",
    })

    const realmResource = new keycloak.Realm("realmResource", {
    realm: "string",
    accessCodeLifespan: "string",
    accessCodeLifespanLogin: "string",
    accessCodeLifespanUserAction: "string",
    accessTokenLifespan: "string",
    accessTokenLifespanForImplicitFlow: "string",
    accountTheme: "string",
    actionTokenGeneratedByAdminLifespan: "string",
    actionTokenGeneratedByUserLifespan: "string",
    adminTheme: "string",
    attributes: {
        string: "string",
    },
    browserFlow: "string",
    clientAuthenticationFlow: "string",
    clientSessionIdleTimeout: "string",
    clientSessionMaxLifespan: "string",
    defaultDefaultClientScopes: ["string"],
    defaultOptionalClientScopes: ["string"],
    defaultSignatureAlgorithm: "string",
    directGrantFlow: "string",
    displayName: "string",
    displayNameHtml: "string",
    dockerAuthenticationFlow: "string",
    duplicateEmailsAllowed: false,
    editUsernameAllowed: false,
    emailTheme: "string",
    enabled: false,
    internalId: "string",
    internationalization: {
        defaultLocale: "string",
        supportedLocales: ["string"],
    },
    loginTheme: "string",
    loginWithEmailAllowed: false,
    oauth2DeviceCodeLifespan: "string",
    oauth2DevicePollingInterval: 0,
    offlineSessionIdleTimeout: "string",
    offlineSessionMaxLifespan: "string",
    offlineSessionMaxLifespanEnabled: false,
    otpPolicy: {
        algorithm: "string",
        digits: 0,
        initialCounter: 0,
        lookAheadWindow: 0,
        period: 0,
        type: "string",
    },
    passwordPolicy: "string",
    refreshTokenMaxReuse: 0,
    registrationAllowed: false,
    registrationEmailAsUsername: false,
    registrationFlow: "string",
    rememberMe: false,
    resetCredentialsFlow: "string",
    resetPasswordAllowed: false,
    revokeRefreshToken: false,
    securityDefenses: {
        bruteForceDetection: {
            failureResetTimeSeconds: 0,
            maxFailureWaitSeconds: 0,
            maxLoginFailures: 0,
            minimumQuickLoginWaitSeconds: 0,
            permanentLockout: false,
            quickLoginCheckMilliSeconds: 0,
            waitIncrementSeconds: 0,
        },
        headers: {
            contentSecurityPolicy: "string",
            contentSecurityPolicyReportOnly: "string",
            referrerPolicy: "string",
            strictTransportSecurity: "string",
            xContentTypeOptions: "string",
            xFrameOptions: "string",
            xRobotsTag: "string",
            xXssProtection: "string",
        },
    },
    smtpServer: {
        from: "string",
        host: "string",
        auth: {
            password: "string",
            username: "string",
        },
        envelopeFrom: "string",
        fromDisplayName: "string",
        port: "string",
        replyTo: "string",
        replyToDisplayName: "string",
        ssl: false,
        starttls: false,
    },
    sslRequired: "string",
    ssoSessionIdleTimeout: "string",
    ssoSessionIdleTimeoutRememberMe: "string",
    ssoSessionMaxLifespan: "string",
    ssoSessionMaxLifespanRememberMe: "string",
    userManagedAccess: false,
    verifyEmail: false,
    webAuthnPasswordlessPolicy: {
        acceptableAaguids: ["string"],
        attestationConveyancePreference: "string",
        authenticatorAttachment: "string",
        avoidSameAuthenticatorRegister: false,
        createTimeout: 0,
        relyingPartyEntityName: "string",
        relyingPartyId: "string",
        requireResidentKey: "string",
        signatureAlgorithms: ["string"],
        userVerificationRequirement: "string",
    },
    webAuthnPolicy: {
        acceptableAaguids: ["string"],
        attestationConveyancePreference: "string",
        authenticatorAttachment: "string",
        avoidSameAuthenticatorRegister: false,
        createTimeout: 0,
        relyingPartyEntityName: "string",
        relyingPartyId: "string",
        requireResidentKey: "string",
        signatureAlgorithms: ["string"],
        userVerificationRequirement: "string",
    },
});

    type: keycloak:Realm
properties:
    accessCodeLifespan: string
    accessCodeLifespanLogin: string
    accessCodeLifespanUserAction: string
    accessTokenLifespan: string
    accessTokenLifespanForImplicitFlow: string
    accountTheme: string
    actionTokenGeneratedByAdminLifespan: string
    actionTokenGeneratedByUserLifespan: string
    adminTheme: string
    attributes:
        string: string
    browserFlow: string
    clientAuthenticationFlow: string
    clientSessionIdleTimeout: string
    clientSessionMaxLifespan: string
    defaultDefaultClientScopes:
        - string
    defaultOptionalClientScopes:
        - string
    defaultSignatureAlgorithm: string
    directGrantFlow: string
    displayName: string
    displayNameHtml: string
    dockerAuthenticationFlow: string
    duplicateEmailsAllowed: false
    editUsernameAllowed: false
    emailTheme: string
    enabled: false
    internalId: string
    internationalization:
        defaultLocale: string
        supportedLocales:
            - string
    loginTheme: string
    loginWithEmailAllowed: false
    oauth2DeviceCodeLifespan: string
    oauth2DevicePollingInterval: 0
    offlineSessionIdleTimeout: string
    offlineSessionMaxLifespan: string
    offlineSessionMaxLifespanEnabled: false
    otpPolicy:
        algorithm: string
        digits: 0
        initialCounter: 0
        lookAheadWindow: 0
        period: 0
        type: string
    passwordPolicy: string
    realm: string
    refreshTokenMaxReuse: 0
    registrationAllowed: false
    registrationEmailAsUsername: false
    registrationFlow: string
    rememberMe: false
    resetCredentialsFlow: string
    resetPasswordAllowed: false
    revokeRefreshToken: false
    securityDefenses:
        bruteForceDetection:
            failureResetTimeSeconds: 0
            maxFailureWaitSeconds: 0
            maxLoginFailures: 0
            minimumQuickLoginWaitSeconds: 0
            permanentLockout: false
            quickLoginCheckMilliSeconds: 0
            waitIncrementSeconds: 0
        headers:
            contentSecurityPolicy: string
            contentSecurityPolicyReportOnly: string
            referrerPolicy: string
            strictTransportSecurity: string
            xContentTypeOptions: string
            xFrameOptions: string
            xRobotsTag: string
            xXssProtection: string
    smtpServer:
        auth:
            password: string
            username: string
        envelopeFrom: string
        from: string
        fromDisplayName: string
        host: string
        port: string
        replyTo: string
        replyToDisplayName: string
        ssl: false
        starttls: false
    sslRequired: string
    ssoSessionIdleTimeout: string
    ssoSessionIdleTimeoutRememberMe: string
    ssoSessionMaxLifespan: string
    ssoSessionMaxLifespanRememberMe: string
    userManagedAccess: false
    verifyEmail: false
    webAuthnPasswordlessPolicy:
        acceptableAaguids:
            - string
        attestationConveyancePreference: string
        authenticatorAttachment: string
        avoidSameAuthenticatorRegister: false
        createTimeout: 0
        relyingPartyEntityName: string
        relyingPartyId: string
        requireResidentKey: string
        signatureAlgorithms:
            - string
        userVerificationRequirement: string
    webAuthnPolicy:
        acceptableAaguids:
            - string
        attestationConveyancePreference: string
        authenticatorAttachment: string
        avoidSameAuthenticatorRegister: false
        createTimeout: 0
        relyingPartyEntityName: string
        relyingPartyId: string
        requireResidentKey: string
        signatureAlgorithms:
            - string
        userVerificationRequirement: string

    Realm Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Realm resource accepts the following input properties:

    RealmName string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    AccessCodeLifespan string
    AccessCodeLifespanLogin string
    AccessCodeLifespanUserAction string
    AccessTokenLifespan string
    AccessTokenLifespanForImplicitFlow string
    AccountTheme string
    ActionTokenGeneratedByAdminLifespan string
    ActionTokenGeneratedByUserLifespan string
    AdminTheme string
    Attributes Dictionary<string, string>
    A map of custom attributes to add to the realm.
    BrowserFlow string
    Which flow should be used for BrowserFlow
    ClientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    ClientSessionIdleTimeout string
    ClientSessionMaxLifespan string
    DefaultDefaultClientScopes List<string>
    DefaultOptionalClientScopes List<string>
    DefaultSignatureAlgorithm string
    DirectGrantFlow string
    Which flow should be used for DirectGrantFlow
    DisplayName string
    The display name for the realm that is shown when logging in to the admin console.
    DisplayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    DockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    DuplicateEmailsAllowed bool
    EditUsernameAllowed bool
    EmailTheme string
    Enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    InternalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    Internationalization RealmInternationalization
    LoginTheme string
    LoginWithEmailAllowed bool
    Oauth2DeviceCodeLifespan string
    Oauth2DevicePollingInterval int
    OfflineSessionIdleTimeout string
    OfflineSessionMaxLifespan string
    OfflineSessionMaxLifespanEnabled bool
    OtpPolicy RealmOtpPolicy
    PasswordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    RefreshTokenMaxReuse int
    RegistrationAllowed bool
    RegistrationEmailAsUsername bool
    RegistrationFlow string
    Which flow should be used for RegistrationFlow
    RememberMe bool
    ResetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    ResetPasswordAllowed bool
    RevokeRefreshToken bool
    SecurityDefenses RealmSecurityDefenses
    SmtpServer RealmSmtpServer
    SslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    SsoSessionIdleTimeout string
    SsoSessionIdleTimeoutRememberMe string
    SsoSessionMaxLifespan string
    SsoSessionMaxLifespanRememberMe string
    UserManagedAccess bool
    When true, users are allowed to manage their own resources. Defaults to false.
    VerifyEmail bool
    WebAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    WebAuthnPolicy RealmWebAuthnPolicy
    Realm string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    AccessCodeLifespan string
    AccessCodeLifespanLogin string
    AccessCodeLifespanUserAction string
    AccessTokenLifespan string
    AccessTokenLifespanForImplicitFlow string
    AccountTheme string
    ActionTokenGeneratedByAdminLifespan string
    ActionTokenGeneratedByUserLifespan string
    AdminTheme string
    Attributes map[string]string
    A map of custom attributes to add to the realm.
    BrowserFlow string
    Which flow should be used for BrowserFlow
    ClientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    ClientSessionIdleTimeout string
    ClientSessionMaxLifespan string
    DefaultDefaultClientScopes []string
    DefaultOptionalClientScopes []string
    DefaultSignatureAlgorithm string
    DirectGrantFlow string
    Which flow should be used for DirectGrantFlow
    DisplayName string
    The display name for the realm that is shown when logging in to the admin console.
    DisplayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    DockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    DuplicateEmailsAllowed bool
    EditUsernameAllowed bool
    EmailTheme string
    Enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    InternalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    Internationalization RealmInternationalizationArgs
    LoginTheme string
    LoginWithEmailAllowed bool
    Oauth2DeviceCodeLifespan string
    Oauth2DevicePollingInterval int
    OfflineSessionIdleTimeout string
    OfflineSessionMaxLifespan string
    OfflineSessionMaxLifespanEnabled bool
    OtpPolicy RealmOtpPolicyArgs
    PasswordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    RefreshTokenMaxReuse int
    RegistrationAllowed bool
    RegistrationEmailAsUsername bool
    RegistrationFlow string
    Which flow should be used for RegistrationFlow
    RememberMe bool
    ResetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    ResetPasswordAllowed bool
    RevokeRefreshToken bool
    SecurityDefenses RealmSecurityDefensesArgs
    SmtpServer RealmSmtpServerArgs
    SslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    SsoSessionIdleTimeout string
    SsoSessionIdleTimeoutRememberMe string
    SsoSessionMaxLifespan string
    SsoSessionMaxLifespanRememberMe string
    UserManagedAccess bool
    When true, users are allowed to manage their own resources. Defaults to false.
    VerifyEmail bool
    WebAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicyArgs
    WebAuthnPolicy RealmWebAuthnPolicyArgs
    realm String
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    accessCodeLifespan String
    accessCodeLifespanLogin String
    accessCodeLifespanUserAction String
    accessTokenLifespan String
    accessTokenLifespanForImplicitFlow String
    accountTheme String
    actionTokenGeneratedByAdminLifespan String
    actionTokenGeneratedByUserLifespan String
    adminTheme String
    attributes Map<String,String>
    A map of custom attributes to add to the realm.
    browserFlow String
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow String
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout String
    clientSessionMaxLifespan String
    defaultDefaultClientScopes List<String>
    defaultOptionalClientScopes List<String>
    defaultSignatureAlgorithm String
    directGrantFlow String
    Which flow should be used for DirectGrantFlow
    displayName String
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml String
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow String
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed Boolean
    editUsernameAllowed Boolean
    emailTheme String
    enabled Boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId String
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalization
    loginTheme String
    loginWithEmailAllowed Boolean
    oauth2DeviceCodeLifespan String
    oauth2DevicePollingInterval Integer
    offlineSessionIdleTimeout String
    offlineSessionMaxLifespan String
    offlineSessionMaxLifespanEnabled Boolean
    otpPolicy RealmOtpPolicy
    passwordPolicy String
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    refreshTokenMaxReuse Integer
    registrationAllowed Boolean
    registrationEmailAsUsername Boolean
    registrationFlow String
    Which flow should be used for RegistrationFlow
    rememberMe Boolean
    resetCredentialsFlow String
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed Boolean
    revokeRefreshToken Boolean
    securityDefenses RealmSecurityDefenses
    smtpServer RealmSmtpServer
    sslRequired String
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout String
    ssoSessionIdleTimeoutRememberMe String
    ssoSessionMaxLifespan String
    ssoSessionMaxLifespanRememberMe String
    userManagedAccess Boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail Boolean
    webAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    webAuthnPolicy RealmWebAuthnPolicy
    realm string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    accessCodeLifespan string
    accessCodeLifespanLogin string
    accessCodeLifespanUserAction string
    accessTokenLifespan string
    accessTokenLifespanForImplicitFlow string
    accountTheme string
    actionTokenGeneratedByAdminLifespan string
    actionTokenGeneratedByUserLifespan string
    adminTheme string
    attributes {[key: string]: string}
    A map of custom attributes to add to the realm.
    browserFlow string
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout string
    clientSessionMaxLifespan string
    defaultDefaultClientScopes string[]
    defaultOptionalClientScopes string[]
    defaultSignatureAlgorithm string
    directGrantFlow string
    Which flow should be used for DirectGrantFlow
    displayName string
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed boolean
    editUsernameAllowed boolean
    emailTheme string
    enabled boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalization
    loginTheme string
    loginWithEmailAllowed boolean
    oauth2DeviceCodeLifespan string
    oauth2DevicePollingInterval number
    offlineSessionIdleTimeout string
    offlineSessionMaxLifespan string
    offlineSessionMaxLifespanEnabled boolean
    otpPolicy RealmOtpPolicy
    passwordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    refreshTokenMaxReuse number
    registrationAllowed boolean
    registrationEmailAsUsername boolean
    registrationFlow string
    Which flow should be used for RegistrationFlow
    rememberMe boolean
    resetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed boolean
    revokeRefreshToken boolean
    securityDefenses RealmSecurityDefenses
    smtpServer RealmSmtpServer
    sslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout string
    ssoSessionIdleTimeoutRememberMe string
    ssoSessionMaxLifespan string
    ssoSessionMaxLifespanRememberMe string
    userManagedAccess boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail boolean
    webAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    webAuthnPolicy RealmWebAuthnPolicy
    realm str
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    access_code_lifespan str
    access_code_lifespan_login str
    access_code_lifespan_user_action str
    access_token_lifespan str
    access_token_lifespan_for_implicit_flow str
    account_theme str
    action_token_generated_by_admin_lifespan str
    action_token_generated_by_user_lifespan str
    admin_theme str
    attributes Mapping[str, str]
    A map of custom attributes to add to the realm.
    browser_flow str
    Which flow should be used for BrowserFlow
    client_authentication_flow str
    Which flow should be used for ClientAuthenticationFlow
    client_session_idle_timeout str
    client_session_max_lifespan str
    default_default_client_scopes Sequence[str]
    default_optional_client_scopes Sequence[str]
    default_signature_algorithm str
    direct_grant_flow str
    Which flow should be used for DirectGrantFlow
    display_name str
    The display name for the realm that is shown when logging in to the admin console.
    display_name_html str
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    docker_authentication_flow str
    Which flow should be used for DockerAuthenticationFlow
    duplicate_emails_allowed bool
    edit_username_allowed bool
    email_theme str
    enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    internal_id str
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalizationArgs
    login_theme str
    login_with_email_allowed bool
    oauth2_device_code_lifespan str
    oauth2_device_polling_interval int
    offline_session_idle_timeout str
    offline_session_max_lifespan str
    offline_session_max_lifespan_enabled bool
    otp_policy RealmOtpPolicyArgs
    password_policy str
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    refresh_token_max_reuse int
    registration_allowed bool
    registration_email_as_username bool
    registration_flow str
    Which flow should be used for RegistrationFlow
    remember_me bool
    reset_credentials_flow str
    Which flow should be used for ResetCredentialsFlow
    reset_password_allowed bool
    revoke_refresh_token bool
    security_defenses RealmSecurityDefensesArgs
    smtp_server RealmSmtpServerArgs
    ssl_required str
    SSL Required: Values can be 'none', 'external' or 'all'.
    sso_session_idle_timeout str
    sso_session_idle_timeout_remember_me str
    sso_session_max_lifespan str
    sso_session_max_lifespan_remember_me str
    user_managed_access bool
    When true, users are allowed to manage their own resources. Defaults to false.
    verify_email bool
    web_authn_passwordless_policy RealmWebAuthnPasswordlessPolicyArgs
    web_authn_policy RealmWebAuthnPolicyArgs
    realm String
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    accessCodeLifespan String
    accessCodeLifespanLogin String
    accessCodeLifespanUserAction String
    accessTokenLifespan String
    accessTokenLifespanForImplicitFlow String
    accountTheme String
    actionTokenGeneratedByAdminLifespan String
    actionTokenGeneratedByUserLifespan String
    adminTheme String
    attributes Map<String>
    A map of custom attributes to add to the realm.
    browserFlow String
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow String
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout String
    clientSessionMaxLifespan String
    defaultDefaultClientScopes List<String>
    defaultOptionalClientScopes List<String>
    defaultSignatureAlgorithm String
    directGrantFlow String
    Which flow should be used for DirectGrantFlow
    displayName String
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml String
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow String
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed Boolean
    editUsernameAllowed Boolean
    emailTheme String
    enabled Boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId String
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization Property Map
    loginTheme String
    loginWithEmailAllowed Boolean
    oauth2DeviceCodeLifespan String
    oauth2DevicePollingInterval Number
    offlineSessionIdleTimeout String
    offlineSessionMaxLifespan String
    offlineSessionMaxLifespanEnabled Boolean
    otpPolicy Property Map
    passwordPolicy String
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    refreshTokenMaxReuse Number
    registrationAllowed Boolean
    registrationEmailAsUsername Boolean
    registrationFlow String
    Which flow should be used for RegistrationFlow
    rememberMe Boolean
    resetCredentialsFlow String
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed Boolean
    revokeRefreshToken Boolean
    securityDefenses Property Map
    smtpServer Property Map
    sslRequired String
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout String
    ssoSessionIdleTimeoutRememberMe String
    ssoSessionMaxLifespan String
    ssoSessionMaxLifespanRememberMe String
    userManagedAccess Boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail Boolean
    webAuthnPasswordlessPolicy Property Map
    webAuthnPolicy Property Map

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Realm resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing Realm Resource

    Get an existing Realm resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: RealmState, opts?: CustomResourceOptions): Realm
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        access_code_lifespan: Optional[str] = None,
        access_code_lifespan_login: Optional[str] = None,
        access_code_lifespan_user_action: Optional[str] = None,
        access_token_lifespan: Optional[str] = None,
        access_token_lifespan_for_implicit_flow: Optional[str] = None,
        account_theme: Optional[str] = None,
        action_token_generated_by_admin_lifespan: Optional[str] = None,
        action_token_generated_by_user_lifespan: Optional[str] = None,
        admin_theme: Optional[str] = None,
        attributes: Optional[Mapping[str, str]] = None,
        browser_flow: Optional[str] = None,
        client_authentication_flow: Optional[str] = None,
        client_session_idle_timeout: Optional[str] = None,
        client_session_max_lifespan: Optional[str] = None,
        default_default_client_scopes: Optional[Sequence[str]] = None,
        default_optional_client_scopes: Optional[Sequence[str]] = None,
        default_signature_algorithm: Optional[str] = None,
        direct_grant_flow: Optional[str] = None,
        display_name: Optional[str] = None,
        display_name_html: Optional[str] = None,
        docker_authentication_flow: Optional[str] = None,
        duplicate_emails_allowed: Optional[bool] = None,
        edit_username_allowed: Optional[bool] = None,
        email_theme: Optional[str] = None,
        enabled: Optional[bool] = None,
        internal_id: Optional[str] = None,
        internationalization: Optional[RealmInternationalizationArgs] = None,
        login_theme: Optional[str] = None,
        login_with_email_allowed: Optional[bool] = None,
        oauth2_device_code_lifespan: Optional[str] = None,
        oauth2_device_polling_interval: Optional[int] = None,
        offline_session_idle_timeout: Optional[str] = None,
        offline_session_max_lifespan: Optional[str] = None,
        offline_session_max_lifespan_enabled: Optional[bool] = None,
        otp_policy: Optional[RealmOtpPolicyArgs] = None,
        password_policy: Optional[str] = None,
        realm: Optional[str] = None,
        refresh_token_max_reuse: Optional[int] = None,
        registration_allowed: Optional[bool] = None,
        registration_email_as_username: Optional[bool] = None,
        registration_flow: Optional[str] = None,
        remember_me: Optional[bool] = None,
        reset_credentials_flow: Optional[str] = None,
        reset_password_allowed: Optional[bool] = None,
        revoke_refresh_token: Optional[bool] = None,
        security_defenses: Optional[RealmSecurityDefensesArgs] = None,
        smtp_server: Optional[RealmSmtpServerArgs] = None,
        ssl_required: Optional[str] = None,
        sso_session_idle_timeout: Optional[str] = None,
        sso_session_idle_timeout_remember_me: Optional[str] = None,
        sso_session_max_lifespan: Optional[str] = None,
        sso_session_max_lifespan_remember_me: Optional[str] = None,
        user_managed_access: Optional[bool] = None,
        verify_email: Optional[bool] = None,
        web_authn_passwordless_policy: Optional[RealmWebAuthnPasswordlessPolicyArgs] = None,
        web_authn_policy: Optional[RealmWebAuthnPolicyArgs] = None) -> Realm
    func GetRealm(ctx *Context, name string, id IDInput, state *RealmState, opts ...ResourceOption) (*Realm, error)
    public static Realm Get(string name, Input<string> id, RealmState? state, CustomResourceOptions? opts = null)
    public static Realm get(String name, Output<String> id, RealmState state, CustomResourceOptions options)
    resources:  _:    type: keycloak:Realm    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccessCodeLifespan string
    AccessCodeLifespanLogin string
    AccessCodeLifespanUserAction string
    AccessTokenLifespan string
    AccessTokenLifespanForImplicitFlow string
    AccountTheme string
    ActionTokenGeneratedByAdminLifespan string
    ActionTokenGeneratedByUserLifespan string
    AdminTheme string
    Attributes Dictionary<string, string>
    A map of custom attributes to add to the realm.
    BrowserFlow string
    Which flow should be used for BrowserFlow
    ClientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    ClientSessionIdleTimeout string
    ClientSessionMaxLifespan string
    DefaultDefaultClientScopes List<string>
    DefaultOptionalClientScopes List<string>
    DefaultSignatureAlgorithm string
    DirectGrantFlow string
    Which flow should be used for DirectGrantFlow
    DisplayName string
    The display name for the realm that is shown when logging in to the admin console.
    DisplayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    DockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    DuplicateEmailsAllowed bool
    EditUsernameAllowed bool
    EmailTheme string
    Enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    InternalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    Internationalization RealmInternationalization
    LoginTheme string
    LoginWithEmailAllowed bool
    Oauth2DeviceCodeLifespan string
    Oauth2DevicePollingInterval int
    OfflineSessionIdleTimeout string
    OfflineSessionMaxLifespan string
    OfflineSessionMaxLifespanEnabled bool
    OtpPolicy RealmOtpPolicy
    PasswordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    RealmName string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    RefreshTokenMaxReuse int
    RegistrationAllowed bool
    RegistrationEmailAsUsername bool
    RegistrationFlow string
    Which flow should be used for RegistrationFlow
    RememberMe bool
    ResetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    ResetPasswordAllowed bool
    RevokeRefreshToken bool
    SecurityDefenses RealmSecurityDefenses
    SmtpServer RealmSmtpServer
    SslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    SsoSessionIdleTimeout string
    SsoSessionIdleTimeoutRememberMe string
    SsoSessionMaxLifespan string
    SsoSessionMaxLifespanRememberMe string
    UserManagedAccess bool
    When true, users are allowed to manage their own resources. Defaults to false.
    VerifyEmail bool
    WebAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    WebAuthnPolicy RealmWebAuthnPolicy
    AccessCodeLifespan string
    AccessCodeLifespanLogin string
    AccessCodeLifespanUserAction string
    AccessTokenLifespan string
    AccessTokenLifespanForImplicitFlow string
    AccountTheme string
    ActionTokenGeneratedByAdminLifespan string
    ActionTokenGeneratedByUserLifespan string
    AdminTheme string
    Attributes map[string]string
    A map of custom attributes to add to the realm.
    BrowserFlow string
    Which flow should be used for BrowserFlow
    ClientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    ClientSessionIdleTimeout string
    ClientSessionMaxLifespan string
    DefaultDefaultClientScopes []string
    DefaultOptionalClientScopes []string
    DefaultSignatureAlgorithm string
    DirectGrantFlow string
    Which flow should be used for DirectGrantFlow
    DisplayName string
    The display name for the realm that is shown when logging in to the admin console.
    DisplayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    DockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    DuplicateEmailsAllowed bool
    EditUsernameAllowed bool
    EmailTheme string
    Enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    InternalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    Internationalization RealmInternationalizationArgs
    LoginTheme string
    LoginWithEmailAllowed bool
    Oauth2DeviceCodeLifespan string
    Oauth2DevicePollingInterval int
    OfflineSessionIdleTimeout string
    OfflineSessionMaxLifespan string
    OfflineSessionMaxLifespanEnabled bool
    OtpPolicy RealmOtpPolicyArgs
    PasswordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    Realm string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    RefreshTokenMaxReuse int
    RegistrationAllowed bool
    RegistrationEmailAsUsername bool
    RegistrationFlow string
    Which flow should be used for RegistrationFlow
    RememberMe bool
    ResetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    ResetPasswordAllowed bool
    RevokeRefreshToken bool
    SecurityDefenses RealmSecurityDefensesArgs
    SmtpServer RealmSmtpServerArgs
    SslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    SsoSessionIdleTimeout string
    SsoSessionIdleTimeoutRememberMe string
    SsoSessionMaxLifespan string
    SsoSessionMaxLifespanRememberMe string
    UserManagedAccess bool
    When true, users are allowed to manage their own resources. Defaults to false.
    VerifyEmail bool
    WebAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicyArgs
    WebAuthnPolicy RealmWebAuthnPolicyArgs
    accessCodeLifespan String
    accessCodeLifespanLogin String
    accessCodeLifespanUserAction String
    accessTokenLifespan String
    accessTokenLifespanForImplicitFlow String
    accountTheme String
    actionTokenGeneratedByAdminLifespan String
    actionTokenGeneratedByUserLifespan String
    adminTheme String
    attributes Map<String,String>
    A map of custom attributes to add to the realm.
    browserFlow String
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow String
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout String
    clientSessionMaxLifespan String
    defaultDefaultClientScopes List<String>
    defaultOptionalClientScopes List<String>
    defaultSignatureAlgorithm String
    directGrantFlow String
    Which flow should be used for DirectGrantFlow
    displayName String
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml String
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow String
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed Boolean
    editUsernameAllowed Boolean
    emailTheme String
    enabled Boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId String
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalization
    loginTheme String
    loginWithEmailAllowed Boolean
    oauth2DeviceCodeLifespan String
    oauth2DevicePollingInterval Integer
    offlineSessionIdleTimeout String
    offlineSessionMaxLifespan String
    offlineSessionMaxLifespanEnabled Boolean
    otpPolicy RealmOtpPolicy
    passwordPolicy String
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    realm String
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    refreshTokenMaxReuse Integer
    registrationAllowed Boolean
    registrationEmailAsUsername Boolean
    registrationFlow String
    Which flow should be used for RegistrationFlow
    rememberMe Boolean
    resetCredentialsFlow String
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed Boolean
    revokeRefreshToken Boolean
    securityDefenses RealmSecurityDefenses
    smtpServer RealmSmtpServer
    sslRequired String
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout String
    ssoSessionIdleTimeoutRememberMe String
    ssoSessionMaxLifespan String
    ssoSessionMaxLifespanRememberMe String
    userManagedAccess Boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail Boolean
    webAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    webAuthnPolicy RealmWebAuthnPolicy
    accessCodeLifespan string
    accessCodeLifespanLogin string
    accessCodeLifespanUserAction string
    accessTokenLifespan string
    accessTokenLifespanForImplicitFlow string
    accountTheme string
    actionTokenGeneratedByAdminLifespan string
    actionTokenGeneratedByUserLifespan string
    adminTheme string
    attributes {[key: string]: string}
    A map of custom attributes to add to the realm.
    browserFlow string
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow string
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout string
    clientSessionMaxLifespan string
    defaultDefaultClientScopes string[]
    defaultOptionalClientScopes string[]
    defaultSignatureAlgorithm string
    directGrantFlow string
    Which flow should be used for DirectGrantFlow
    displayName string
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml string
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow string
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed boolean
    editUsernameAllowed boolean
    emailTheme string
    enabled boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId string
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalization
    loginTheme string
    loginWithEmailAllowed boolean
    oauth2DeviceCodeLifespan string
    oauth2DevicePollingInterval number
    offlineSessionIdleTimeout string
    offlineSessionMaxLifespan string
    offlineSessionMaxLifespanEnabled boolean
    otpPolicy RealmOtpPolicy
    passwordPolicy string
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    realm string
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    refreshTokenMaxReuse number
    registrationAllowed boolean
    registrationEmailAsUsername boolean
    registrationFlow string
    Which flow should be used for RegistrationFlow
    rememberMe boolean
    resetCredentialsFlow string
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed boolean
    revokeRefreshToken boolean
    securityDefenses RealmSecurityDefenses
    smtpServer RealmSmtpServer
    sslRequired string
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout string
    ssoSessionIdleTimeoutRememberMe string
    ssoSessionMaxLifespan string
    ssoSessionMaxLifespanRememberMe string
    userManagedAccess boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail boolean
    webAuthnPasswordlessPolicy RealmWebAuthnPasswordlessPolicy
    webAuthnPolicy RealmWebAuthnPolicy
    access_code_lifespan str
    access_code_lifespan_login str
    access_code_lifespan_user_action str
    access_token_lifespan str
    access_token_lifespan_for_implicit_flow str
    account_theme str
    action_token_generated_by_admin_lifespan str
    action_token_generated_by_user_lifespan str
    admin_theme str
    attributes Mapping[str, str]
    A map of custom attributes to add to the realm.
    browser_flow str
    Which flow should be used for BrowserFlow
    client_authentication_flow str
    Which flow should be used for ClientAuthenticationFlow
    client_session_idle_timeout str
    client_session_max_lifespan str
    default_default_client_scopes Sequence[str]
    default_optional_client_scopes Sequence[str]
    default_signature_algorithm str
    direct_grant_flow str
    Which flow should be used for DirectGrantFlow
    display_name str
    The display name for the realm that is shown when logging in to the admin console.
    display_name_html str
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    docker_authentication_flow str
    Which flow should be used for DockerAuthenticationFlow
    duplicate_emails_allowed bool
    edit_username_allowed bool
    email_theme str
    enabled bool
    When false, users and clients will not be able to access this realm. Defaults to true.
    internal_id str
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization RealmInternationalizationArgs
    login_theme str
    login_with_email_allowed bool
    oauth2_device_code_lifespan str
    oauth2_device_polling_interval int
    offline_session_idle_timeout str
    offline_session_max_lifespan str
    offline_session_max_lifespan_enabled bool
    otp_policy RealmOtpPolicyArgs
    password_policy str
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    realm str
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    refresh_token_max_reuse int
    registration_allowed bool
    registration_email_as_username bool
    registration_flow str
    Which flow should be used for RegistrationFlow
    remember_me bool
    reset_credentials_flow str
    Which flow should be used for ResetCredentialsFlow
    reset_password_allowed bool
    revoke_refresh_token bool
    security_defenses RealmSecurityDefensesArgs
    smtp_server RealmSmtpServerArgs
    ssl_required str
    SSL Required: Values can be 'none', 'external' or 'all'.
    sso_session_idle_timeout str
    sso_session_idle_timeout_remember_me str
    sso_session_max_lifespan str
    sso_session_max_lifespan_remember_me str
    user_managed_access bool
    When true, users are allowed to manage their own resources. Defaults to false.
    verify_email bool
    web_authn_passwordless_policy RealmWebAuthnPasswordlessPolicyArgs
    web_authn_policy RealmWebAuthnPolicyArgs
    accessCodeLifespan String
    accessCodeLifespanLogin String
    accessCodeLifespanUserAction String
    accessTokenLifespan String
    accessTokenLifespanForImplicitFlow String
    accountTheme String
    actionTokenGeneratedByAdminLifespan String
    actionTokenGeneratedByUserLifespan String
    adminTheme String
    attributes Map<String>
    A map of custom attributes to add to the realm.
    browserFlow String
    Which flow should be used for BrowserFlow
    clientAuthenticationFlow String
    Which flow should be used for ClientAuthenticationFlow
    clientSessionIdleTimeout String
    clientSessionMaxLifespan String
    defaultDefaultClientScopes List<String>
    defaultOptionalClientScopes List<String>
    defaultSignatureAlgorithm String
    directGrantFlow String
    Which flow should be used for DirectGrantFlow
    displayName String
    The display name for the realm that is shown when logging in to the admin console.
    displayNameHtml String
    The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.
    dockerAuthenticationFlow String
    Which flow should be used for DockerAuthenticationFlow
    duplicateEmailsAllowed Boolean
    editUsernameAllowed Boolean
    emailTheme String
    enabled Boolean
    When false, users and clients will not be able to access this realm. Defaults to true.
    internalId String
    When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.
    internationalization Property Map
    loginTheme String
    loginWithEmailAllowed Boolean
    oauth2DeviceCodeLifespan String
    oauth2DevicePollingInterval Number
    offlineSessionIdleTimeout String
    offlineSessionMaxLifespan String
    offlineSessionMaxLifespanEnabled Boolean
    otpPolicy Property Map
    passwordPolicy String
    String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"
    realm String
    The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.
    refreshTokenMaxReuse Number
    registrationAllowed Boolean
    registrationEmailAsUsername Boolean
    registrationFlow String
    Which flow should be used for RegistrationFlow
    rememberMe Boolean
    resetCredentialsFlow String
    Which flow should be used for ResetCredentialsFlow
    resetPasswordAllowed Boolean
    revokeRefreshToken Boolean
    securityDefenses Property Map
    smtpServer Property Map
    sslRequired String
    SSL Required: Values can be 'none', 'external' or 'all'.
    ssoSessionIdleTimeout String
    ssoSessionIdleTimeoutRememberMe String
    ssoSessionMaxLifespan String
    ssoSessionMaxLifespanRememberMe String
    userManagedAccess Boolean
    When true, users are allowed to manage their own resources. Defaults to false.
    verifyEmail Boolean
    webAuthnPasswordlessPolicy Property Map
    webAuthnPolicy Property Map

    Supporting Types

    RealmInternationalization, RealmInternationalizationArgs

    DefaultLocale string
    The locale to use by default. This locale code must be present within the supported_locales list.
    SupportedLocales List<string>
    A list of ISO 639-1 locale codes that the realm should support.
    DefaultLocale string
    The locale to use by default. This locale code must be present within the supported_locales list.
    SupportedLocales []string
    A list of ISO 639-1 locale codes that the realm should support.
    defaultLocale String
    The locale to use by default. This locale code must be present within the supported_locales list.
    supportedLocales List<String>
    A list of ISO 639-1 locale codes that the realm should support.
    defaultLocale string
    The locale to use by default. This locale code must be present within the supported_locales list.
    supportedLocales string[]
    A list of ISO 639-1 locale codes that the realm should support.
    default_locale str
    The locale to use by default. This locale code must be present within the supported_locales list.
    supported_locales Sequence[str]
    A list of ISO 639-1 locale codes that the realm should support.
    defaultLocale String
    The locale to use by default. This locale code must be present within the supported_locales list.
    supportedLocales List<String>
    A list of ISO 639-1 locale codes that the realm should support.

    RealmOtpPolicy, RealmOtpPolicyArgs

    Algorithm string
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    Digits int
    How many digits the OTP have. Defaults to 6.
    InitialCounter int
    What should the initial counter value be. Defaults to 2.
    LookAheadWindow int
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    Period int
    How many seconds should an OTP token be valid. Defaults to 30.
    Type string
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
    Algorithm string
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    Digits int
    How many digits the OTP have. Defaults to 6.
    InitialCounter int
    What should the initial counter value be. Defaults to 2.
    LookAheadWindow int
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    Period int
    How many seconds should an OTP token be valid. Defaults to 30.
    Type string
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
    algorithm String
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    digits Integer
    How many digits the OTP have. Defaults to 6.
    initialCounter Integer
    What should the initial counter value be. Defaults to 2.
    lookAheadWindow Integer
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    period Integer
    How many seconds should an OTP token be valid. Defaults to 30.
    type String
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
    algorithm string
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    digits number
    How many digits the OTP have. Defaults to 6.
    initialCounter number
    What should the initial counter value be. Defaults to 2.
    lookAheadWindow number
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    period number
    How many seconds should an OTP token be valid. Defaults to 30.
    type string
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
    algorithm str
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    digits int
    How many digits the OTP have. Defaults to 6.
    initial_counter int
    What should the initial counter value be. Defaults to 2.
    look_ahead_window int
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    period int
    How many seconds should an OTP token be valid. Defaults to 30.
    type str
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.
    algorithm String
    What hashing algorithm should be used to generate the OTP, Valid options are HmacSHA1,HmacSHA256 and HmacSHA512. Defaults to HmacSHA1.
    digits Number
    How many digits the OTP have. Defaults to 6.
    initialCounter Number
    What should the initial counter value be. Defaults to 2.
    lookAheadWindow Number
    How far ahead should the server look just in case the token generator and server are out of time sync or counter sync. Defaults to 1.
    period Number
    How many seconds should an OTP token be valid. Defaults to 30.
    type String
    One Time Password Type, supported Values are totp for Time-Based One Time Password and hotp for Counter Based. Defaults to totp.

    RealmSecurityDefenses, RealmSecurityDefensesArgs

    RealmSecurityDefensesBruteForceDetection, RealmSecurityDefensesBruteForceDetectionArgs

    FailureResetTimeSeconds int
    When will failure count be reset?
    MaxFailureWaitSeconds int
    MaxLoginFailures int
    How many failures before wait is triggered.
    MinimumQuickLoginWaitSeconds int
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    PermanentLockout bool
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    QuickLoginCheckMilliSeconds int
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    WaitIncrementSeconds int
    This represents the amount of time a user should be locked out when the login failure threshold has been met.
    FailureResetTimeSeconds int
    When will failure count be reset?
    MaxFailureWaitSeconds int
    MaxLoginFailures int
    How many failures before wait is triggered.
    MinimumQuickLoginWaitSeconds int
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    PermanentLockout bool
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    QuickLoginCheckMilliSeconds int
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    WaitIncrementSeconds int
    This represents the amount of time a user should be locked out when the login failure threshold has been met.
    failureResetTimeSeconds Integer
    When will failure count be reset?
    maxFailureWaitSeconds Integer
    maxLoginFailures Integer
    How many failures before wait is triggered.
    minimumQuickLoginWaitSeconds Integer
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    permanentLockout Boolean
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    quickLoginCheckMilliSeconds Integer
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    waitIncrementSeconds Integer
    This represents the amount of time a user should be locked out when the login failure threshold has been met.
    failureResetTimeSeconds number
    When will failure count be reset?
    maxFailureWaitSeconds number
    maxLoginFailures number
    How many failures before wait is triggered.
    minimumQuickLoginWaitSeconds number
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    permanentLockout boolean
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    quickLoginCheckMilliSeconds number
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    waitIncrementSeconds number
    This represents the amount of time a user should be locked out when the login failure threshold has been met.
    failure_reset_time_seconds int
    When will failure count be reset?
    max_failure_wait_seconds int
    max_login_failures int
    How many failures before wait is triggered.
    minimum_quick_login_wait_seconds int
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    permanent_lockout bool
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    quick_login_check_milli_seconds int
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    wait_increment_seconds int
    This represents the amount of time a user should be locked out when the login failure threshold has been met.
    failureResetTimeSeconds Number
    When will failure count be reset?
    maxFailureWaitSeconds Number
    maxLoginFailures Number
    How many failures before wait is triggered.
    minimumQuickLoginWaitSeconds Number
    How long to wait after a quick login failure.

    • max_failure_wait_seconds - (Optional) Max. time a user will be locked out.
    permanentLockout Boolean
    When true, this will lock the user permanently when the user exceeds the maximum login failures.
    quickLoginCheckMilliSeconds Number
    Configures the amount of time, in milliseconds, for consecutive failures to lock a user out.
    waitIncrementSeconds Number
    This represents the amount of time a user should be locked out when the login failure threshold has been met.

    RealmSecurityDefensesHeaders, RealmSecurityDefensesHeadersArgs

    ContentSecurityPolicy string
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    ContentSecurityPolicyReportOnly string
    Used for testing Content Security Policies.
    ReferrerPolicy string
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    StrictTransportSecurity string
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    XContentTypeOptions string
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    XFrameOptions string
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    XRobotsTag string
    Prevent pages from appearing in search engines.
    XXssProtection string
    This header configures the Cross-site scripting (XSS) filter in your browser.
    ContentSecurityPolicy string
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    ContentSecurityPolicyReportOnly string
    Used for testing Content Security Policies.
    ReferrerPolicy string
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    StrictTransportSecurity string
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    XContentTypeOptions string
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    XFrameOptions string
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    XRobotsTag string
    Prevent pages from appearing in search engines.
    XXssProtection string
    This header configures the Cross-site scripting (XSS) filter in your browser.
    contentSecurityPolicy String
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    contentSecurityPolicyReportOnly String
    Used for testing Content Security Policies.
    referrerPolicy String
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    strictTransportSecurity String
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    xContentTypeOptions String
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    xFrameOptions String
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    xRobotsTag String
    Prevent pages from appearing in search engines.
    xXssProtection String
    This header configures the Cross-site scripting (XSS) filter in your browser.
    contentSecurityPolicy string
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    contentSecurityPolicyReportOnly string
    Used for testing Content Security Policies.
    referrerPolicy string
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    strictTransportSecurity string
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    xContentTypeOptions string
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    xFrameOptions string
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    xRobotsTag string
    Prevent pages from appearing in search engines.
    xXssProtection string
    This header configures the Cross-site scripting (XSS) filter in your browser.
    content_security_policy str
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    content_security_policy_report_only str
    Used for testing Content Security Policies.
    referrer_policy str
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    strict_transport_security str
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    x_content_type_options str
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    x_frame_options str
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    x_robots_tag str
    Prevent pages from appearing in search engines.
    x_xss_protection str
    This header configures the Cross-site scripting (XSS) filter in your browser.
    contentSecurityPolicy String
    Sets the Content Security Policy, which can be used for prevent pages from being included by non-origin iframes. More information can be found in the W3C-CSP Abstract.
    contentSecurityPolicyReportOnly String
    Used for testing Content Security Policies.
    referrerPolicy String
    The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests.
    strictTransportSecurity String
    The Script-Transport-Security HTTP header tells browsers to always use HTTPS.
    xContentTypeOptions String
    Sets the X-Content-Type-Options, which can be used for prevent MIME-sniffing a response away from the declared content-type
    xFrameOptions String
    Sets the x-frame-option, which can be used to prevent pages from being included by non-origin iframes. More information can be found in the RFC7034
    xRobotsTag String
    Prevent pages from appearing in search engines.
    xXssProtection String
    This header configures the Cross-site scripting (XSS) filter in your browser.

    RealmSmtpServer, RealmSmtpServerArgs

    From string
    The email address for the sender.
    Host string
    The host of the SMTP server.
    Auth RealmSmtpServerAuth
    Enables authentication to the SMTP server. This block supports the following arguments:
    EnvelopeFrom string
    The email address uses for bounces.
    FromDisplayName string
    The display name of the sender email address.
    Port string
    The port of the SMTP server (defaults to 25).
    ReplyTo string
    The "reply to" email address.
    ReplyToDisplayName string
    The display name of the "reply to" email address.
    Ssl bool
    When true, enables SSL. Defaults to false.
    Starttls bool
    When true, enables StartTLS. Defaults to false.
    From string
    The email address for the sender.
    Host string
    The host of the SMTP server.
    Auth RealmSmtpServerAuth
    Enables authentication to the SMTP server. This block supports the following arguments:
    EnvelopeFrom string
    The email address uses for bounces.
    FromDisplayName string
    The display name of the sender email address.
    Port string
    The port of the SMTP server (defaults to 25).
    ReplyTo string
    The "reply to" email address.
    ReplyToDisplayName string
    The display name of the "reply to" email address.
    Ssl bool
    When true, enables SSL. Defaults to false.
    Starttls bool
    When true, enables StartTLS. Defaults to false.
    from String
    The email address for the sender.
    host String
    The host of the SMTP server.
    auth RealmSmtpServerAuth
    Enables authentication to the SMTP server. This block supports the following arguments:
    envelopeFrom String
    The email address uses for bounces.
    fromDisplayName String
    The display name of the sender email address.
    port String
    The port of the SMTP server (defaults to 25).
    replyTo String
    The "reply to" email address.
    replyToDisplayName String
    The display name of the "reply to" email address.
    ssl Boolean
    When true, enables SSL. Defaults to false.
    starttls Boolean
    When true, enables StartTLS. Defaults to false.
    from string
    The email address for the sender.
    host string
    The host of the SMTP server.
    auth RealmSmtpServerAuth
    Enables authentication to the SMTP server. This block supports the following arguments:
    envelopeFrom string
    The email address uses for bounces.
    fromDisplayName string
    The display name of the sender email address.
    port string
    The port of the SMTP server (defaults to 25).
    replyTo string
    The "reply to" email address.
    replyToDisplayName string
    The display name of the "reply to" email address.
    ssl boolean
    When true, enables SSL. Defaults to false.
    starttls boolean
    When true, enables StartTLS. Defaults to false.
    from_ str
    The email address for the sender.
    host str
    The host of the SMTP server.
    auth RealmSmtpServerAuth
    Enables authentication to the SMTP server. This block supports the following arguments:
    envelope_from str
    The email address uses for bounces.
    from_display_name str
    The display name of the sender email address.
    port str
    The port of the SMTP server (defaults to 25).
    reply_to str
    The "reply to" email address.
    reply_to_display_name str
    The display name of the "reply to" email address.
    ssl bool
    When true, enables SSL. Defaults to false.
    starttls bool
    When true, enables StartTLS. Defaults to false.
    from String
    The email address for the sender.
    host String
    The host of the SMTP server.
    auth Property Map
    Enables authentication to the SMTP server. This block supports the following arguments:
    envelopeFrom String
    The email address uses for bounces.
    fromDisplayName String
    The display name of the sender email address.
    port String
    The port of the SMTP server (defaults to 25).
    replyTo String
    The "reply to" email address.
    replyToDisplayName String
    The display name of the "reply to" email address.
    ssl Boolean
    When true, enables SSL. Defaults to false.
    starttls Boolean
    When true, enables StartTLS. Defaults to false.

    RealmSmtpServerAuth, RealmSmtpServerAuthArgs

    Password string
    The SMTP server password.
    Username string
    The SMTP server username.
    Password string
    The SMTP server password.
    Username string
    The SMTP server username.
    password String
    The SMTP server password.
    username String
    The SMTP server username.
    password string
    The SMTP server password.
    username string
    The SMTP server username.
    password str
    The SMTP server password.
    username str
    The SMTP server username.
    password String
    The SMTP server password.
    username String
    The SMTP server username.

    RealmWebAuthnPasswordlessPolicy, RealmWebAuthnPasswordlessPolicyArgs

    AcceptableAaguids List<string>
    A set of AAGUIDs for which an authenticator can be registered.
    AttestationConveyancePreference string
    Either none, indirect or direct
    AuthenticatorAttachment string
    Either platform or cross-platform
    AvoidSameAuthenticatorRegister bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    CreateTimeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    RelyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    RelyingPartyId string
    The WebAuthn relying party ID.
    RequireResidentKey string
    Either Yes or No
    SignatureAlgorithms List<string>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    UserVerificationRequirement string
    Either required, preferred or discouraged
    AcceptableAaguids []string
    A set of AAGUIDs for which an authenticator can be registered.
    AttestationConveyancePreference string
    Either none, indirect or direct
    AuthenticatorAttachment string
    Either platform or cross-platform
    AvoidSameAuthenticatorRegister bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    CreateTimeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    RelyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    RelyingPartyId string
    The WebAuthn relying party ID.
    RequireResidentKey string
    Either Yes or No
    SignatureAlgorithms []string
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    UserVerificationRequirement string
    Either required, preferred or discouraged
    acceptableAaguids List<String>
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference String
    Either none, indirect or direct
    authenticatorAttachment String
    Either platform or cross-platform
    avoidSameAuthenticatorRegister Boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout Integer
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName String
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId String
    The WebAuthn relying party ID.
    requireResidentKey String
    Either Yes or No
    signatureAlgorithms List<String>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement String
    Either required, preferred or discouraged
    acceptableAaguids string[]
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference string
    Either none, indirect or direct
    authenticatorAttachment string
    Either platform or cross-platform
    avoidSameAuthenticatorRegister boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout number
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId string
    The WebAuthn relying party ID.
    requireResidentKey string
    Either Yes or No
    signatureAlgorithms string[]
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement string
    Either required, preferred or discouraged
    acceptable_aaguids Sequence[str]
    A set of AAGUIDs for which an authenticator can be registered.
    attestation_conveyance_preference str
    Either none, indirect or direct
    authenticator_attachment str
    Either platform or cross-platform
    avoid_same_authenticator_register bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    create_timeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relying_party_entity_name str
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relying_party_id str
    The WebAuthn relying party ID.
    require_resident_key str
    Either Yes or No
    signature_algorithms Sequence[str]
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    user_verification_requirement str
    Either required, preferred or discouraged
    acceptableAaguids List<String>
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference String
    Either none, indirect or direct
    authenticatorAttachment String
    Either platform or cross-platform
    avoidSameAuthenticatorRegister Boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout Number
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName String
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId String
    The WebAuthn relying party ID.
    requireResidentKey String
    Either Yes or No
    signatureAlgorithms List<String>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement String
    Either required, preferred or discouraged

    RealmWebAuthnPolicy, RealmWebAuthnPolicyArgs

    AcceptableAaguids List<string>
    A set of AAGUIDs for which an authenticator can be registered.
    AttestationConveyancePreference string
    Either none, indirect or direct
    AuthenticatorAttachment string
    Either platform or cross-platform
    AvoidSameAuthenticatorRegister bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    CreateTimeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    RelyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    RelyingPartyId string
    The WebAuthn relying party ID.
    RequireResidentKey string
    Either Yes or No
    SignatureAlgorithms List<string>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    UserVerificationRequirement string
    Either required, preferred or discouraged
    AcceptableAaguids []string
    A set of AAGUIDs for which an authenticator can be registered.
    AttestationConveyancePreference string
    Either none, indirect or direct
    AuthenticatorAttachment string
    Either platform or cross-platform
    AvoidSameAuthenticatorRegister bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    CreateTimeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    RelyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    RelyingPartyId string
    The WebAuthn relying party ID.
    RequireResidentKey string
    Either Yes or No
    SignatureAlgorithms []string
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    UserVerificationRequirement string
    Either required, preferred or discouraged
    acceptableAaguids List<String>
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference String
    Either none, indirect or direct
    authenticatorAttachment String
    Either platform or cross-platform
    avoidSameAuthenticatorRegister Boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout Integer
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName String
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId String
    The WebAuthn relying party ID.
    requireResidentKey String
    Either Yes or No
    signatureAlgorithms List<String>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement String
    Either required, preferred or discouraged
    acceptableAaguids string[]
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference string
    Either none, indirect or direct
    authenticatorAttachment string
    Either platform or cross-platform
    avoidSameAuthenticatorRegister boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout number
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName string
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId string
    The WebAuthn relying party ID.
    requireResidentKey string
    Either Yes or No
    signatureAlgorithms string[]
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement string
    Either required, preferred or discouraged
    acceptable_aaguids Sequence[str]
    A set of AAGUIDs for which an authenticator can be registered.
    attestation_conveyance_preference str
    Either none, indirect or direct
    authenticator_attachment str
    Either platform or cross-platform
    avoid_same_authenticator_register bool
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    create_timeout int
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relying_party_entity_name str
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relying_party_id str
    The WebAuthn relying party ID.
    require_resident_key str
    Either Yes or No
    signature_algorithms Sequence[str]
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    user_verification_requirement str
    Either required, preferred or discouraged
    acceptableAaguids List<String>
    A set of AAGUIDs for which an authenticator can be registered.
    attestationConveyancePreference String
    Either none, indirect or direct
    authenticatorAttachment String
    Either platform or cross-platform
    avoidSameAuthenticatorRegister Boolean
    When true, Keycloak will avoid registering the authenticator for WebAuthn if it has already been registered. Defaults to false.
    createTimeout Number
    The timeout value for creating a user's public key credential in seconds. When set to 0, this timeout option is not adapted. Defaults to 0.
    relyingPartyEntityName String
    A human-readable server name for the WebAuthn Relying Party. Defaults to keycloak.
    relyingPartyId String
    The WebAuthn relying party ID.
    requireResidentKey String
    Either Yes or No
    signatureAlgorithms List<String>
    Keycloak lists ES256, ES384, ES512, RS256, RS384, RS512, RS1 at the time of writing
    userVerificationRequirement String
    Either required, preferred or discouraged

    Import

    Realms can be imported using their name.

    Example:

    bash

    $ pulumi import keycloak:index/realm:Realm realm my-realm

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Keycloak pulumi/pulumi-keycloak
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the keycloak Terraform Provider.
    keycloak logo
    Keycloak v6.2.1 published on Monday, Feb 3, 2025 by Pulumi
    pulumi/pulumi-keycloak