pulumi-keycloak-kotlin/com.pulumi.keycloak.kotlin/Realm

Realm

class Realm : KotlinCustomResource

Allows for creating and managing Realms within Keycloak. A realm manages a logical collection of users, credentials, roles, and groups. Users log in to realms and can be federated from multiple sources.

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as keycloak from "@pulumi/keycloak";
const realm = new keycloak.Realm("realm", {
    realm: "my-realm",
    enabled: true,
    displayName: "my realm",
    displayNameHtml: "<b>my realm</b>",
    loginTheme: "base",
    accessCodeLifespan: "1h",
    sslRequired: "external",
    passwordPolicy: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
    attributes: {
        mycustomAttribute: "myCustomValue",
    },
    smtpServer: {
        host: "smtp.example.com",
        from: "example@example.com",
        auth: {
            username: "tom",
            password: "password",
        },
    },
    internationalization: {
        supportedLocales: [
            "en",
            "de",
            "es",
        ],
        defaultLocale: "en",
    },
    securityDefenses: {
        headers: {
            xFrameOptions: "DENY",
            contentSecurityPolicy: "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
            contentSecurityPolicyReportOnly: "",
            xContentTypeOptions: "nosniff",
            xRobotsTag: "none",
            xXssProtection: "1; mode=block",
            strictTransportSecurity: "max-age=31536000; includeSubDomains",
        },
        bruteForceDetection: {
            permanentLockout: false,
            maxLoginFailures: 30,
            waitIncrementSeconds: 60,
            quickLoginCheckMilliSeconds: 1000,
            minimumQuickLoginWaitSeconds: 60,
            maxFailureWaitSeconds: 900,
            failureResetTimeSeconds: 43200,
        },
    },
    webAuthnPolicy: {
        relyingPartyEntityName: "Example",
        relyingPartyId: "keycloak.example.com",
        signatureAlgorithms: [
            "ES256",
            "RS256",
        ],
    },
});

import pulumi
import pulumi_keycloak as keycloak
realm = keycloak.Realm("realm",
    realm="my-realm",
    enabled=True,
    display_name="my realm",
    display_name_html="<b>my realm</b>",
    login_theme="base",
    access_code_lifespan="1h",
    ssl_required="external",
    password_policy="upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
    attributes={
        "mycustomAttribute": "myCustomValue",
    },
    smtp_server={
        "host": "smtp.example.com",
        "from_": "example@example.com",
        "auth": {
            "username": "tom",
            "password": "password",
        },
    },
    internationalization={
        "supported_locales": [
            "en",
            "de",
            "es",
        ],
        "default_locale": "en",
    },
    security_defenses={
        "headers": {
            "x_frame_options": "DENY",
            "content_security_policy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
            "content_security_policy_report_only": "",
            "x_content_type_options": "nosniff",
            "x_robots_tag": "none",
            "x_xss_protection": "1; mode=block",
            "strict_transport_security": "max-age=31536000; includeSubDomains",
        },
        "brute_force_detection": {
            "permanent_lockout": False,
            "max_login_failures": 30,
            "wait_increment_seconds": 60,
            "quick_login_check_milli_seconds": 1000,
            "minimum_quick_login_wait_seconds": 60,
            "max_failure_wait_seconds": 900,
            "failure_reset_time_seconds": 43200,
        },
    },
    web_authn_policy={
        "relying_party_entity_name": "Example",
        "relying_party_id": "keycloak.example.com",
        "signature_algorithms": [
            "ES256",
            "RS256",
        ],
    })

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Keycloak = Pulumi.Keycloak;
return await Deployment.RunAsync(() =>
{
    var realm = new Keycloak.Realm("realm", new()
    {
        RealmName = "my-realm",
        Enabled = true,
        DisplayName = "my realm",
        DisplayNameHtml = "<b>my realm</b>",
        LoginTheme = "base",
        AccessCodeLifespan = "1h",
        SslRequired = "external",
        PasswordPolicy = "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername",
        Attributes =
        {
            { "mycustomAttribute", "myCustomValue" },
        },
        SmtpServer = new Keycloak.Inputs.RealmSmtpServerArgs
        {
            Host = "smtp.example.com",
            From = "example@example.com",
            Auth = new Keycloak.Inputs.RealmSmtpServerAuthArgs
            {
                Username = "tom",
                Password = "password",
            },
        },
        Internationalization = new Keycloak.Inputs.RealmInternationalizationArgs
        {
            SupportedLocales = new[]
            {
                "en",
                "de",
                "es",
            },
            DefaultLocale = "en",
        },
        SecurityDefenses = new Keycloak.Inputs.RealmSecurityDefensesArgs
        {
            Headers = new Keycloak.Inputs.RealmSecurityDefensesHeadersArgs
            {
                XFrameOptions = "DENY",
                ContentSecurityPolicy = "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
                ContentSecurityPolicyReportOnly = "",
                XContentTypeOptions = "nosniff",
                XRobotsTag = "none",
                XXssProtection = "1; mode=block",
                StrictTransportSecurity = "max-age=31536000; includeSubDomains",
            },
            BruteForceDetection = new Keycloak.Inputs.RealmSecurityDefensesBruteForceDetectionArgs
            {
                PermanentLockout = false,
                MaxLoginFailures = 30,
                WaitIncrementSeconds = 60,
                QuickLoginCheckMilliSeconds = 1000,
                MinimumQuickLoginWaitSeconds = 60,
                MaxFailureWaitSeconds = 900,
                FailureResetTimeSeconds = 43200,
            },
        },
        WebAuthnPolicy = new Keycloak.Inputs.RealmWebAuthnPolicyArgs
        {
            RelyingPartyEntityName = "Example",
            RelyingPartyId = "keycloak.example.com",
            SignatureAlgorithms = new[]
            {
                "ES256",
                "RS256",
            },
        },
    });
});

package main
import (
	"github.com/pulumi/pulumi-keycloak/sdk/v6/go/keycloak"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := keycloak.NewRealm(ctx, "realm", &keycloak.RealmArgs{
			Realm:              pulumi.String("my-realm"),
			Enabled:            pulumi.Bool(true),
			DisplayName:        pulumi.String("my realm"),
			DisplayNameHtml:    pulumi.String("<b>my realm</b>"),
			LoginTheme:         pulumi.String("base"),
			AccessCodeLifespan: pulumi.String("1h"),
			SslRequired:        pulumi.String("external"),
			PasswordPolicy:     pulumi.String("upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername"),
			Attributes: pulumi.StringMap{
				"mycustomAttribute": pulumi.String("myCustomValue"),
			},
			SmtpServer: &keycloak.RealmSmtpServerArgs{
				Host: pulumi.String("smtp.example.com"),
				From: pulumi.String("example@example.com"),
				Auth: &keycloak.RealmSmtpServerAuthArgs{
					Username: pulumi.String("tom"),
					Password: pulumi.String("password"),
				},
			},
			Internationalization: &keycloak.RealmInternationalizationArgs{
				SupportedLocales: pulumi.StringArray{
					pulumi.String("en"),
					pulumi.String("de"),
					pulumi.String("es"),
				},
				DefaultLocale: pulumi.String("en"),
			},
			SecurityDefenses: &keycloak.RealmSecurityDefensesArgs{
				Headers: &keycloak.RealmSecurityDefensesHeadersArgs{
					XFrameOptions:                   pulumi.String("DENY"),
					ContentSecurityPolicy:           pulumi.String("frame-src 'self'; frame-ancestors 'self'; object-src 'none';"),
					ContentSecurityPolicyReportOnly: pulumi.String(""),
					XContentTypeOptions:             pulumi.String("nosniff"),
					XRobotsTag:                      pulumi.String("none"),
					XXssProtection:                  pulumi.String("1; mode=block"),
					StrictTransportSecurity:         pulumi.String("max-age=31536000; includeSubDomains"),
				},
				BruteForceDetection: &keycloak.RealmSecurityDefensesBruteForceDetectionArgs{
					PermanentLockout:             pulumi.Bool(false),
					MaxLoginFailures:             pulumi.Int(30),
					WaitIncrementSeconds:         pulumi.Int(60),
					QuickLoginCheckMilliSeconds:  pulumi.Int(1000),
					MinimumQuickLoginWaitSeconds: pulumi.Int(60),
					MaxFailureWaitSeconds:        pulumi.Int(900),
					FailureResetTimeSeconds:      pulumi.Int(43200),
				},
			},
			WebAuthnPolicy: &keycloak.RealmWebAuthnPolicyArgs{
				RelyingPartyEntityName: pulumi.String("Example"),
				RelyingPartyId:         pulumi.String("keycloak.example.com"),
				SignatureAlgorithms: pulumi.StringArray{
					pulumi.String("ES256"),
					pulumi.String("RS256"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.keycloak.Realm;
import com.pulumi.keycloak.RealmArgs;
import com.pulumi.keycloak.inputs.RealmSmtpServerArgs;
import com.pulumi.keycloak.inputs.RealmSmtpServerAuthArgs;
import com.pulumi.keycloak.inputs.RealmInternationalizationArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesHeadersArgs;
import com.pulumi.keycloak.inputs.RealmSecurityDefensesBruteForceDetectionArgs;
import com.pulumi.keycloak.inputs.RealmWebAuthnPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var realm = new Realm("realm", RealmArgs.builder()
            .realm("my-realm")
            .enabled(true)
            .displayName("my realm")
            .displayNameHtml("<b>my realm</b>")
            .loginTheme("base")
            .accessCodeLifespan("1h")
            .sslRequired("external")
            .passwordPolicy("upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername")
            .attributes(Map.of("mycustomAttribute", "myCustomValue"))
            .smtpServer(RealmSmtpServerArgs.builder()
                .host("smtp.example.com")
                .from("example@example.com")
                .auth(RealmSmtpServerAuthArgs.builder()
                    .username("tom")
                    .password("password")
                    .build())
                .build())
            .internationalization(RealmInternationalizationArgs.builder()
                .supportedLocales(
                    "en",
                    "de",
                    "es")
                .defaultLocale("en")
                .build())
            .securityDefenses(RealmSecurityDefensesArgs.builder()
                .headers(RealmSecurityDefensesHeadersArgs.builder()
                    .xFrameOptions("DENY")
                    .contentSecurityPolicy("frame-src 'self'; frame-ancestors 'self'; object-src 'none';")
                    .contentSecurityPolicyReportOnly("")
                    .xContentTypeOptions("nosniff")
                    .xRobotsTag("none")
                    .xXssProtection("1; mode=block")
                    .strictTransportSecurity("max-age=31536000; includeSubDomains")
                    .build())
                .bruteForceDetection(RealmSecurityDefensesBruteForceDetectionArgs.builder()
                    .permanentLockout(false)
                    .maxLoginFailures(30)
                    .waitIncrementSeconds(60)
                    .quickLoginCheckMilliSeconds(1000)
                    .minimumQuickLoginWaitSeconds(60)
                    .maxFailureWaitSeconds(900)
                    .failureResetTimeSeconds(43200)
                    .build())
                .build())
            .webAuthnPolicy(RealmWebAuthnPolicyArgs.builder()
                .relyingPartyEntityName("Example")
                .relyingPartyId("keycloak.example.com")
                .signatureAlgorithms(
                    "ES256",
                    "RS256")
                .build())
            .build());
    }
}

resources:
  realm:
    type: keycloak:Realm
    properties:
      realm: my-realm
      enabled: true
      displayName: my realm
      displayNameHtml: <b>my realm</b>
      loginTheme: base
      accessCodeLifespan: 1h
      sslRequired: external
      passwordPolicy: upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername
      attributes:
        mycustomAttribute: myCustomValue
      smtpServer:
        host: smtp.example.com
        from: example@example.com
        auth:
          username: tom
          password: password
      internationalization:
        supportedLocales:
          - en
          - de
          - es
        defaultLocale: en
      securityDefenses:
        headers:
          xFrameOptions: DENY
          contentSecurityPolicy: frame-src 'self'; frame-ancestors 'self'; object-src 'none';
          contentSecurityPolicyReportOnly: ""
          xContentTypeOptions: nosniff
          xRobotsTag: none
          xXssProtection: 1; mode=block
          strictTransportSecurity: max-age=31536000; includeSubDomains
        bruteForceDetection:
          permanentLockout: false
          maxLoginFailures: 30
          waitIncrementSeconds: 60
          quickLoginCheckMilliSeconds: 1000
          minimumQuickLoginWaitSeconds: 60
          maxFailureWaitSeconds: 900
          failureResetTimeSeconds: 43200
      webAuthnPolicy:
        relyingPartyEntityName: Example
        relyingPartyId: keycloak.example.com
        signatureAlgorithms:
          - ES256
          - RS256

Default Client Scopes

default_default_client_scopes - (Optional) A list of default default client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default default client-scopes. For an alternative, please refer to the dedicated resource keycloak.RealmDefaultClientScopes.
default_optional_client_scopes - (Optional) A list of default optional client scopes to be used for client definitions. Defaults to [] or keycloak's built-in default optional client-scopes. For an alternative, please refer to the dedicated resource keycloak.RealmOptionalClientScopes.

Import

Realms can be imported using their name. Example: bash

$ pulumi import keycloak:index/realm:Realm realm my-realm

Properties

accessCodeLifespan

val accessCodeLifespan: Output<String>

accessCodeLifespanLogin

val accessCodeLifespanLogin: Output<String>

accessCodeLifespanUserAction

val accessCodeLifespanUserAction: Output<String>

accessTokenLifespan

val accessTokenLifespan: Output<String>

accessTokenLifespanForImplicitFlow

val accessTokenLifespanForImplicitFlow: Output<String>

accountTheme

val accountTheme: Output<String>?

actionTokenGeneratedByAdminLifespan

val actionTokenGeneratedByAdminLifespan: Output<String>

actionTokenGeneratedByUserLifespan

val actionTokenGeneratedByUserLifespan: Output<String>

adminTheme

val adminTheme: Output<String>?

attributes

val attributes: Output<Map<String, String>>?

A map of custom attributes to add to the realm.

browserFlow

val browserFlow: Output<String>

Which flow should be used for BrowserFlow

clientAuthenticationFlow

val clientAuthenticationFlow: Output<String>

Which flow should be used for ClientAuthenticationFlow

clientSessionIdleTimeout

val clientSessionIdleTimeout: Output<String>

clientSessionMaxLifespan

val clientSessionMaxLifespan: Output<String>

defaultDefaultClientScopes

val defaultDefaultClientScopes: Output<List<String>>?

defaultOptionalClientScopes

val defaultOptionalClientScopes: Output<List<String>>?

defaultSignatureAlgorithm

val defaultSignatureAlgorithm: Output<String>?

directGrantFlow

val directGrantFlow: Output<String>

Which flow should be used for DirectGrantFlow

displayName

val displayName: Output<String>?

The display name for the realm that is shown when logging in to the admin console.

displayNameHtml

val displayNameHtml: Output<String>?

The display name for the realm that is rendered as HTML on the screen when logging in to the admin console.

dockerAuthenticationFlow

val dockerAuthenticationFlow: Output<String>

Which flow should be used for DockerAuthenticationFlow

duplicateEmailsAllowed

val duplicateEmailsAllowed: Output<Boolean>

editUsernameAllowed

val editUsernameAllowed: Output<Boolean>

emailTheme

val emailTheme: Output<String>?

enabled

val enabled: Output<Boolean>?

When false, users and clients will not be able to access this realm. Defaults to true.

firstBrokerLoginFlow

val firstBrokerLoginFlow: Output<String>

Which flow should be used for FirstBrokerLoginFlow

val id: Output<String>

internalId

val internalId: Output<String>

When specified, this will be used as the realm's internal ID within Keycloak. When not specified, the realm's internal ID will be set to the realm's name.

internationalization

val internationalization: Output<RealmInternationalization>?

loginTheme

val loginTheme: Output<String>?

loginWithEmailAllowed

val loginWithEmailAllowed: Output<Boolean>

oauth2DeviceCodeLifespan

val oauth2DeviceCodeLifespan: Output<String>

oauth2DevicePollingInterval

val oauth2DevicePollingInterval: Output<Int>

offlineSessionIdleTimeout

val offlineSessionIdleTimeout: Output<String>

offlineSessionMaxLifespan

val offlineSessionMaxLifespan: Output<String>

offlineSessionMaxLifespanEnabled

val offlineSessionMaxLifespanEnabled: Output<Boolean>?

organizationsEnabled

val organizationsEnabled: Output<Boolean>?

When true, organization support is enabled. Defaults to false.

otpPolicy

val otpPolicy: Output<RealmOtpPolicy>

passwordPolicy

val passwordPolicy: Output<String>?

String that represents the passwordPolicies that are in place. Each policy is separated with " and ". Supported policies can be found in the server-info providers page. example: "upperCase(1) and length(8) and forceExpiredPasswordChange(365) and notUsername(undefined)"

pulumiChildResources

val pulumiChildResources: Set<KotlinResource>

pulumiResourceName

val pulumiResourceName: String

pulumiResourceType

val pulumiResourceType: String

realm

val realm: Output<String>

The name of the realm. This is unique across Keycloak. This will also be used as the realm's internal ID within Keycloak.

refreshTokenMaxReuse

val refreshTokenMaxReuse: Output<Int>?

registrationAllowed