REFERENCE.md

# Reference

<!-- DO NOT EDIT: This document was generated by Puppet Strings -->

## Table of Contents

### Classes

#### Public Classes

* [`keycloak`](#keycloak): Manage Keycloak
* [`keycloak::config`](#keycloak--config): Private class.
* [`keycloak::install`](#keycloak--install): Private class.
* [`keycloak::service`](#keycloak--service): Private class.
* [`keycloak::sssd`](#keycloak--sssd): Private class.

#### Private Classes

* `keycloak::db::mariadb`: Manage MySQL DB
* `keycloak::db::mysql`: Manage MySQL DB
* `keycloak::db::postgres`: Manage postgres DB
* `keycloak::resources`: Define Keycloak resources

### Defined types

* [`keycloak::client_scope::oidc`](#keycloak--client_scope--oidc): Manage Keycloak OpenID Connect client scope using built-in mappers
* [`keycloak::client_scope::saml`](#keycloak--client_scope--saml): Manage Keycloak SAML client scope using built-in mappers
* [`keycloak::freeipa_ldap_mappers`](#keycloak--freeipa_ldap_mappers): setup FreeIPA LDAP mappers for Keycloak
* [`keycloak::freeipa_user_provider`](#keycloak--freeipa_user_provider): setup IPA as an LDAP user provider for Keycloak
* [`keycloak::partial_import`](#keycloak--partial_import): Perform partialImport using CLI
* [`keycloak::spi_deployment`](#keycloak--spi_deployment): Manage Keycloak SPI deployment
* [`keycloak::truststore::host`](#keycloak--truststore--host): Add host to Keycloak truststore

### Resource types

* [`keycloak_api`](#keycloak_api): Type that configures API connection parameters for other keycloak types that use the Keycloak API.
* [`keycloak_client`](#keycloak_client): Manage Keycloak clients
* [`keycloak_client_protocol_mapper`](#keycloak_client_protocol_mapper): Manage Keycloak protocol mappers
* [`keycloak_client_scope`](#keycloak_client_scope): Manage Keycloak client scopes
* [`keycloak_conn_validator`](#keycloak_conn_validator): Verify that a connection can be successfully established between a node and the keycloak server.  Its primary use is as a precondition to pre
* [`keycloak_flow`](#keycloak_flow): Manage a Keycloak flow **Autorequires** * `keycloak_realm` defined for `realm` parameter * `keycloak_flow` of `flow_alias` if `top_level=fals
* [`keycloak_flow_execution`](#keycloak_flow_execution): Manage a Keycloak flow **Autorequires** * `keycloak_realm` defined for `realm` parameter * `keycloak_flow` of value defined for `flow_alias` 
* [`keycloak_identity_provider`](#keycloak_identity_provider): Manage Keycloak identity providers
* [`keycloak_ldap_mapper`](#keycloak_ldap_mapper): Manage Keycloak LDAP attribute mappers
* [`keycloak_ldap_user_provider`](#keycloak_ldap_user_provider): Manage Keycloak LDAP user providers
* [`keycloak_protocol_mapper`](#keycloak_protocol_mapper): Manage Keycloak client scope protocol mappers
* [`keycloak_realm`](#keycloak_realm): Manage Keycloak realms
* [`keycloak_required_action`](#keycloak_required_action): Manage Keycloak required actions
* [`keycloak_resource_validator`](#keycloak_resource_validator): Verify that a specific Keycloak resource is available
* [`keycloak_role_mapping`](#keycloak_role_mapping): Attach realm roles to users and groups
* [`keycloak_sssd_user_provider`](#keycloak_sssd_user_provider): Manage Keycloak SSSD user providers

### Data types

* [`Keycloak::Configs`](#Keycloak--Configs): https://www.keycloak.org/server/all-config

## Classes

### <a name="keycloak"></a>`keycloak`

Manage Keycloak

#### Examples

##### 

```puppet
include ::keycloak
```

#### Parameters

The following parameters are available in the `keycloak` class:

* [`manage_install`](#-keycloak--manage_install)
* [`version`](#-keycloak--version)
* [`package_url`](#-keycloak--package_url)
* [`install_dir`](#-keycloak--install_dir)
* [`java_package_dependencies`](#-keycloak--java_package_dependencies)
* [`java_declare_method`](#-keycloak--java_declare_method)
* [`java_package`](#-keycloak--java_package)
* [`java_home`](#-keycloak--java_home)
* [`java_alternative_path`](#-keycloak--java_alternative_path)
* [`java_alternative`](#-keycloak--java_alternative)
* [`service_name`](#-keycloak--service_name)
* [`service_ensure`](#-keycloak--service_ensure)
* [`service_enable`](#-keycloak--service_enable)
* [`java_opts`](#-keycloak--java_opts)
* [`start_command`](#-keycloak--start_command)
* [`service_extra_opts`](#-keycloak--service_extra_opts)
* [`service_environment_file`](#-keycloak--service_environment_file)
* [`conf_dir_mode`](#-keycloak--conf_dir_mode)
* [`conf_dir_purge`](#-keycloak--conf_dir_purge)
* [`conf_dir_purge_ignore`](#-keycloak--conf_dir_purge_ignore)
* [`configs`](#-keycloak--configs)
* [`extra_configs`](#-keycloak--extra_configs)
* [`hostname`](#-keycloak--hostname)
* [`http_enabled`](#-keycloak--http_enabled)
* [`http_host`](#-keycloak--http_host)
* [`http_port`](#-keycloak--http_port)
* [`https_port`](#-keycloak--https_port)
* [`http_relative_path`](#-keycloak--http_relative_path)
* [`manage_user`](#-keycloak--manage_user)
* [`user`](#-keycloak--user)
* [`user_shell`](#-keycloak--user_shell)
* [`group`](#-keycloak--group)
* [`user_uid`](#-keycloak--user_uid)
* [`group_gid`](#-keycloak--group_gid)
* [`system_user`](#-keycloak--system_user)
* [`admin_user`](#-keycloak--admin_user)
* [`admin_user_password`](#-keycloak--admin_user_password)
* [`manage_db`](#-keycloak--manage_db)
* [`manage_db_server`](#-keycloak--manage_db_server)
* [`db`](#-keycloak--db)
* [`db_url_host`](#-keycloak--db_url_host)
* [`db_url_port`](#-keycloak--db_url_port)
* [`db_url`](#-keycloak--db_url)
* [`db_url_database`](#-keycloak--db_url_database)
* [`db_username`](#-keycloak--db_username)
* [`db_password`](#-keycloak--db_password)
* [`db_charset`](#-keycloak--db_charset)
* [`db_collate`](#-keycloak--db_collate)
* [`db_encoding`](#-keycloak--db_encoding)
* [`features`](#-keycloak--features)
* [`features_disabled`](#-keycloak--features_disabled)
* [`truststore`](#-keycloak--truststore)
* [`truststore_hosts`](#-keycloak--truststore_hosts)
* [`truststore_password`](#-keycloak--truststore_password)
* [`proxy`](#-keycloak--proxy)
* [`realms`](#-keycloak--realms)
* [`realms_merge`](#-keycloak--realms_merge)
* [`oidc_client_scopes`](#-keycloak--oidc_client_scopes)
* [`oidc_client_scopes_merge`](#-keycloak--oidc_client_scopes_merge)
* [`saml_client_scopes`](#-keycloak--saml_client_scopes)
* [`saml_client_scopes_merge`](#-keycloak--saml_client_scopes_merge)
* [`identity_providers`](#-keycloak--identity_providers)
* [`identity_providers_merge`](#-keycloak--identity_providers_merge)
* [`client_protocol_mappers`](#-keycloak--client_protocol_mappers)
* [`client_scopes`](#-keycloak--client_scopes)
* [`client_scopes_merge`](#-keycloak--client_scopes_merge)
* [`protocol_mappers`](#-keycloak--protocol_mappers)
* [`protocol_mappers_merge`](#-keycloak--protocol_mappers_merge)
* [`clients`](#-keycloak--clients)
* [`clients_merge`](#-keycloak--clients_merge)
* [`flows`](#-keycloak--flows)
* [`flows_merge`](#-keycloak--flows_merge)
* [`flow_executions`](#-keycloak--flow_executions)
* [`flow_executions_merge`](#-keycloak--flow_executions_merge)
* [`required_actions`](#-keycloak--required_actions)
* [`required_actions_merge`](#-keycloak--required_actions_merge)
* [`ldap_mappers`](#-keycloak--ldap_mappers)
* [`ldap_mappers_merge`](#-keycloak--ldap_mappers_merge)
* [`ldap_user_providers`](#-keycloak--ldap_user_providers)
* [`ldap_user_providers_merge`](#-keycloak--ldap_user_providers_merge)
* [`role_mappings`](#-keycloak--role_mappings)
* [`role_mapping_merge`](#-keycloak--role_mapping_merge)
* [`with_sssd_support`](#-keycloak--with_sssd_support)
* [`libunix_dbus_java_source`](#-keycloak--libunix_dbus_java_source)
* [`install_libunix_dbus_java_build_dependencies`](#-keycloak--install_libunix_dbus_java_build_dependencies)
* [`libunix_dbus_java_build_dependencies`](#-keycloak--libunix_dbus_java_build_dependencies)
* [`libunix_dbus_java_libdir`](#-keycloak--libunix_dbus_java_libdir)
* [`jna_package_name`](#-keycloak--jna_package_name)
* [`manage_sssd_config`](#-keycloak--manage_sssd_config)
* [`sssd_ifp_user_attributes`](#-keycloak--sssd_ifp_user_attributes)
* [`restart_sssd`](#-keycloak--restart_sssd)
* [`spi_deployments`](#-keycloak--spi_deployments)
* [`partial_imports`](#-keycloak--partial_imports)
* [`providers_purge`](#-keycloak--providers_purge)
* [`custom_config_content`](#-keycloak--custom_config_content)
* [`custom_config_source`](#-keycloak--custom_config_source)
* [`validator_test_url`](#-keycloak--validator_test_url)

##### <a name="-keycloak--manage_install"></a>`manage_install`

Data type: `Boolean`

Install Keycloak from upstream Keycloak tarball.
Set to false to manage installation of Keycloak outside
this module and set $install_dir to match.
Defaults to true.

Default value: `true`

##### <a name="-keycloak--version"></a>`version`

Data type: `String`

Version of Keycloak to install and manage.

Default value: `'25.0.1'`

##### <a name="-keycloak--package_url"></a>`package_url`

Data type: `Optional[Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl, Stdlib::Absolutepath]]`

URL of the Keycloak download.
Default is based on version.

Default value: `undef`

##### <a name="-keycloak--install_dir"></a>`install_dir`

Data type: `Optional[Stdlib::Absolutepath]`

The directory of where to install Keycloak.
Default is `/opt/keycloak-${version}`.

Default value: `undef`

##### <a name="-keycloak--java_package_dependencies"></a>`java_package_dependencies`

Data type: `Array[String[1]]`

Packages to install before Java

Default value: `[]`

##### <a name="-keycloak--java_declare_method"></a>`java_declare_method`

Data type: `Enum['include','class']`

How to declare the Java class within this module
The `include` value only includes the java class
The `class` method defines the Java class and passes necessary parameters
For RedHat base systems this defaults to `class`, other OSes default to `include`

Default value: `'class'`

##### <a name="-keycloak--java_package"></a>`java_package`

Data type: `String[1]`

Java package name, only used when `java_declare_method` is `class`

Default value: `'java-21-openjdk-devel'`

##### <a name="-keycloak--java_home"></a>`java_home`

Data type: `Stdlib::Absolutepath`

Java home path.  This value is used when `java_declare_method` is `class`
as well as to set JAVA_HOME environment variable for the Keycloak service.

Default value: `'/usr/lib/jvm/java-21-openjdk'`

##### <a name="-keycloak--java_alternative_path"></a>`java_alternative_path`

Data type: `Stdlib::Absolutepath`

Java alternative path, only used when `java_declare_method` is `class`

Default value: `'/usr/lib/jvm/java-21-openjdk/bin/java'`

##### <a name="-keycloak--java_alternative"></a>`java_alternative`

Data type: `String[1]`

Java alternative, only used when `java_declare_method` is `class`

Default value: `'/usr/lib/jvm/java-21-openjdk/bin/java'`

##### <a name="-keycloak--service_name"></a>`service_name`

Data type: `String`

Keycloak service name.
Default is `keycloak`.

Default value: `'keycloak'`

##### <a name="-keycloak--service_ensure"></a>`service_ensure`

Data type: `String`

Keycloak service ensure property.
Default is `running`.

Default value: `'running'`

##### <a name="-keycloak--service_enable"></a>`service_enable`

Data type: `Boolean`

Keycloak service enable property.
Default is `true`.

Default value: `true`

##### <a name="-keycloak--java_opts"></a>`java_opts`

Data type: `Optional[Variant[String, Array]]`

Sets additional options to Java virtual machine environment variable.

Default value: `undef`

##### <a name="-keycloak--start_command"></a>`start_command`

Data type: `Enum['start','start-dev']`

The start command to use to run Keycloak

Default value: `'start'`

##### <a name="-keycloak--service_extra_opts"></a>`service_extra_opts`

Data type: `Optional[String]`

Additional options added to the end of the service command-line.

Default value: `undef`

##### <a name="-keycloak--service_environment_file"></a>`service_environment_file`

Data type: `Optional[Stdlib::Absolutepath]`

Path to the file with environment variables for the systemd service

Default value: `undef`

##### <a name="-keycloak--conf_dir_mode"></a>`conf_dir_mode`

Data type: `Stdlib::Filemode`

The mode for the configuration directory

Default value: `'0755'`

##### <a name="-keycloak--conf_dir_purge"></a>`conf_dir_purge`

Data type: `Boolean`

Purge unmanaged files in configuration directory

Default value: `true`

##### <a name="-keycloak--conf_dir_purge_ignore"></a>`conf_dir_purge_ignore`

Data type: `Array`

The files to ignore when unmanaged files are purged from the configuration directory

Default value: `['cache-ispn.xml', 'README.md', 'truststore.jks', 'kcadm.config']`

##### <a name="-keycloak--configs"></a>`configs`

Data type: `Keycloak::Configs`

Define additional configs for keycloak.conf

Default value: `{}`

##### <a name="-keycloak--extra_configs"></a>`extra_configs`

Data type: `Hash[String, Variant[String[1],Boolean,Array]]`

Additional configs for keycloak.conf

Default value: `{}`

##### <a name="-keycloak--hostname"></a>`hostname`

Data type: `Variant[Stdlib::Host, Stdlib::HTTPUrl, Stdlib::HTTPSUrl, Enum['unset','UNSET']]`

hostname to set in keycloak.conf
Set to `unset` or `UNSET` to not define this in keycloak.conf

Default value: `$facts['networking']['fqdn']`

##### <a name="-keycloak--http_enabled"></a>`http_enabled`

Data type: `Boolean`

Whether to enable HTTP

Default value: `true`

##### <a name="-keycloak--http_host"></a>`http_host`

Data type: `Stdlib::IP::Address`

HTTP host

Default value: `'0.0.0.0'`

##### <a name="-keycloak--http_port"></a>`http_port`

Data type: `Stdlib::Port`

HTTP port

Default value: `8080`

##### <a name="-keycloak--https_port"></a>`https_port`

Data type: `Stdlib::Port`

HTTPS port

Default value: `8443`

##### <a name="-keycloak--http_relative_path"></a>`http_relative_path`

Data type: `Pattern[/^\/.*/]`

Set the path relative to '/' for serving resources. The path must start with a '/'.

Default value: `'/'`

##### <a name="-keycloak--manage_user"></a>`manage_user`

Data type: `Boolean`

Defines if the module should manage the Linux user for Keycloak installation

Default value: `true`

##### <a name="-keycloak--user"></a>`user`

Data type: `String`

Keycloak user name.
Default is `keycloak`.

Default value: `'keycloak'`

##### <a name="-keycloak--user_shell"></a>`user_shell`

Data type: `Stdlib::Absolutepath`

Keycloak user shell.

Default value: `'/sbin/nologin'`

##### <a name="-keycloak--group"></a>`group`

Data type: `String`

Keycloak user group name.
Default is `keycloak`.

Default value: `'keycloak'`

##### <a name="-keycloak--user_uid"></a>`user_uid`

Data type: `Optional[Integer]`

Keycloak user UID.
Default is `undef`.

Default value: `undef`

##### <a name="-keycloak--group_gid"></a>`group_gid`

Data type: `Optional[Integer]`

Keycloak user group GID.
Default is `undef`.

Default value: `undef`

##### <a name="-keycloak--system_user"></a>`system_user`

Data type: `Boolean`

If keycloak user should be a system user with lower uid and gid.
Default is `true`

Default value: `true`

##### <a name="-keycloak--admin_user"></a>`admin_user`

Data type: `String`

Keycloak administrative username.
Default is `admin`.

Default value: `'admin'`

##### <a name="-keycloak--admin_user_password"></a>`admin_user_password`

Data type: `String`

Keycloak administrative user password.
Default is `changeme`.

Default value: `'changeme'`

##### <a name="-keycloak--manage_db"></a>`manage_db`

Data type: `Boolean`

Boolean that determines if configured database will be managed.

Default value: `true`

##### <a name="-keycloak--manage_db_server"></a>`manage_db_server`

Data type: `Boolean`

Include the DB server class for postgres, mariadb or mysql

Default value: `true`

##### <a name="-keycloak--db"></a>`db`

Data type: `Enum['dev-file', 'dev-mem', 'mariadb', 'mysql', 'oracle', 'postgres']`

Database driver to use for Keycloak.

Default value: `'dev-file'`

##### <a name="-keycloak--db_url_host"></a>`db_url_host`

Data type: `Optional[Stdlib::Host]`

Database host.

Default value: `undef`

##### <a name="-keycloak--db_url_port"></a>`db_url_port`

Data type: `Optional[Stdlib::Port]`

Database port.

Default value: `undef`

##### <a name="-keycloak--db_url"></a>`db_url`

Data type: `Optional[String[1]]`

Database url.

Default value: `undef`

##### <a name="-keycloak--db_url_database"></a>`db_url_database`

Data type: `String[1]`

Database name.

Default value: `'keycloak'`

##### <a name="-keycloak--db_username"></a>`db_username`

Data type: `String[1]`

Database user name.

Default value: `'keycloak'`

##### <a name="-keycloak--db_password"></a>`db_password`

Data type: `String[1]`

Database user password.

Default value: `'changeme'`

##### <a name="-keycloak--db_charset"></a>`db_charset`

Data type: `String`

MySQL and MariaDB database charset

Default value: `'utf8'`

##### <a name="-keycloak--db_collate"></a>`db_collate`

Data type: `String`

MySQL and MariaDB database collate

Default value: `'utf8_general_ci'`

##### <a name="-keycloak--db_encoding"></a>`db_encoding`

Data type: `String`

PostgreSQL database encoding

Default value: `'UTF8'`

##### <a name="-keycloak--features"></a>`features`

Data type: `Optional[Array[String[1]]]`

Keycloak features to enable

Default value: `undef`

##### <a name="-keycloak--features_disabled"></a>`features_disabled`

Data type: `Optional[Array[String[1]]]`

Keycloak features to disable

Default value: `undef`

##### <a name="-keycloak--truststore"></a>`truststore`

Data type: `Boolean`

Boolean that sets if truststore should be used.
Default is `false`.

Default value: `false`

##### <a name="-keycloak--truststore_hosts"></a>`truststore_hosts`

Data type: `Hash`

Hash that is used to define `keycloak::turststore::host` resources.
Default is `{}`.

Default value: `{}`

##### <a name="-keycloak--truststore_password"></a>`truststore_password`

Data type: `String`

Truststore password.
Default is `keycloak`.

Default value: `'keycloak'`

##### <a name="-keycloak--proxy"></a>`proxy`

Data type: `Enum['edge','reencrypt','passthrough','none']`

Type of proxy to use for Keycloak

Default value: `'none'`

##### <a name="-keycloak--realms"></a>`realms`

Data type: `Hash`

Hash that is used to define keycloak_realm resources.
Default is `{}`.

Default value: `{}`

##### <a name="-keycloak--realms_merge"></a>`realms_merge`

Data type: `Boolean`

Boolean that sets if `realms` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--oidc_client_scopes"></a>`oidc_client_scopes`

Data type: `Hash`

Hash that is used to define keycloak::client_scope::oidc resources.
Default is `{}`.

Default value: `{}`

##### <a name="-keycloak--oidc_client_scopes_merge"></a>`oidc_client_scopes_merge`

Data type: `Boolean`

Boolean that sets if `oidc_client_scopes` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--saml_client_scopes"></a>`saml_client_scopes`

Data type: `Hash`

Hash that is used to define keycloak::client_scope::saml resources.
Default is `{}`.

Default value: `{}`

##### <a name="-keycloak--saml_client_scopes_merge"></a>`saml_client_scopes_merge`

Data type: `Boolean`

Boolean that sets if `saml_client_scopes` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--identity_providers"></a>`identity_providers`

Data type: `Hash`

Hash that is used to define keycloak_identity_provider resources.

Default value: `{}`

##### <a name="-keycloak--identity_providers_merge"></a>`identity_providers_merge`

Data type: `Boolean`

Boolean that sets if `identity_providers` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--client_protocol_mappers"></a>`client_protocol_mappers`

Data type: `Hash`

Hash that is used to define keycloak_client_protocol_mapper resources.

Default value: `{}`

##### <a name="-keycloak--client_scopes"></a>`client_scopes`

Data type: `Hash`

Hash that is used to define keycloak_client_scope resources.

Default value: `{}`

##### <a name="-keycloak--client_scopes_merge"></a>`client_scopes_merge`

Data type: `Boolean`

Boolean that sets if `client_scopes` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--protocol_mappers"></a>`protocol_mappers`

Data type: `Hash`

Hash that is used to define keycloak_protocol_mapper resources.

Default value: `{}`

##### <a name="-keycloak--protocol_mappers_merge"></a>`protocol_mappers_merge`

Data type: `Boolean`

Boolean that sets if `protocol_mappers` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--clients"></a>`clients`

Data type: `Hash`

Hash that is used to define keycloak_client resources.

Default value: `{}`

##### <a name="-keycloak--clients_merge"></a>`clients_merge`

Data type: `Boolean`

Boolean that sets if `clients` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--flows"></a>`flows`

Data type: `Hash`

Hash taht is used to define keycloak_flow resources.

Default value: `{}`

##### <a name="-keycloak--flows_merge"></a>`flows_merge`

Data type: `Boolean`

Boolean that sets if `flows` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--flow_executions"></a>`flow_executions`

Data type: `Hash`

Hash taht is used to define keycloak_flow resources.

Default value: `{}`

##### <a name="-keycloak--flow_executions_merge"></a>`flow_executions_merge`

Data type: `Boolean`

Boolean that sets if `flows` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--required_actions"></a>`required_actions`

Data type: `Hash`

Hash that is used to define keycloak_required_action resources.

Default value: `{}`

##### <a name="-keycloak--required_actions_merge"></a>`required_actions_merge`

Data type: `Boolean`

Boolean that sets if `required_actions` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--ldap_mappers"></a>`ldap_mappers`

Data type: `Hash`

Hash that is used to define keycloak_ldap_mapper resources.

Default value: `{}`

##### <a name="-keycloak--ldap_mappers_merge"></a>`ldap_mappers_merge`

Data type: `Boolean`

Boolean that sets if `ldap_mappers` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--ldap_user_providers"></a>`ldap_user_providers`

Data type: `Hash`

Hash that is used to define keycloak_ldap_user_provider resources.

Default value: `{}`

##### <a name="-keycloak--ldap_user_providers_merge"></a>`ldap_user_providers_merge`

Data type: `Boolean`

Boolean that sets if `ldap_user_providers` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--role_mappings"></a>`role_mappings`

Data type: `Hash`

Hash that is used to define keycloak_role_mapping resources.

Default value: `{}`

##### <a name="-keycloak--role_mapping_merge"></a>`role_mapping_merge`

Data type: `Boolean`

Boolean that sets if `role_mappings` should be merged from Hiera.

Default value: `false`

##### <a name="-keycloak--with_sssd_support"></a>`with_sssd_support`

Data type: `Boolean`

Boolean that determines if SSSD user provider support should be available

Default value: `false`

##### <a name="-keycloak--libunix_dbus_java_source"></a>`libunix_dbus_java_source`

Data type: `Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl]`

Source URL of libunix-dbus-java

Default value: `'https://github.com/keycloak/libunix-dbus-java/archive/libunix-dbus-java-0.8.0.tar.gz'`

##### <a name="-keycloak--install_libunix_dbus_java_build_dependencies"></a>`install_libunix_dbus_java_build_dependencies`

Data type: `Boolean`

Boolean that determines of libunix-dbus-java build dependencies are managed by this module

Default value: `true`

##### <a name="-keycloak--libunix_dbus_java_build_dependencies"></a>`libunix_dbus_java_build_dependencies`

Data type: `Array`

Packages needed to build libunix-dbus-java

Default value: `[]`

##### <a name="-keycloak--libunix_dbus_java_libdir"></a>`libunix_dbus_java_libdir`

Data type: `Stdlib::Absolutepath`

Path to directory to install libunix-dbus-java libraries

Default value: `'/usr/lib64'`

##### <a name="-keycloak--jna_package_name"></a>`jna_package_name`

Data type: `String`

Package name for jna

Default value: `'jna'`

##### <a name="-keycloak--manage_sssd_config"></a>`manage_sssd_config`

Data type: `Boolean`

Boolean that determines if SSSD ifp config for Keycloak is managed

Default value: `true`

##### <a name="-keycloak--sssd_ifp_user_attributes"></a>`sssd_ifp_user_attributes`

Data type: `Array`

user_attributes to define for SSSD ifp service

Default value: `[]`

##### <a name="-keycloak--restart_sssd"></a>`restart_sssd`

Data type: `Boolean`

Boolean that determines if SSSD should be restarted

Default value: `true`

##### <a name="-keycloak--spi_deployments"></a>`spi_deployments`

Data type: `Hash`

Hash used to define keycloak::spi_deployment resources

Default value: `{}`

##### <a name="-keycloak--partial_imports"></a>`partial_imports`

Data type: `Hash`

Hash used to define keycloak::partial_import resources

Default value: `{}`

##### <a name="-keycloak--providers_purge"></a>`providers_purge`

Data type: `Boolean`

Purge the providers directory of unmanaged SPIs

Default value: `true`

##### <a name="-keycloak--custom_config_content"></a>`custom_config_content`

Data type: `Optional[String]`

Custom configuration content to be added to keycloak.conf

Default value: `undef`

##### <a name="-keycloak--custom_config_source"></a>`custom_config_source`

Data type: `Optional[Variant[String, Array]]`

Custom configuration source file to be added to keycloak.conf

Default value: `undef`

##### <a name="-keycloak--validator_test_url"></a>`validator_test_url`

Data type: `String`

The URL path for validator testing
Only necessary to set if the URL path to Keycloak is modified

Default value: `'/realms/master/.well-known/openid-configuration'`

### <a name="keycloak--config"></a>`keycloak::config`

Private class.

### <a name="keycloak--install"></a>`keycloak::install`

Private class.

### <a name="keycloak--service"></a>`keycloak::service`

Private class.

### <a name="keycloak--sssd"></a>`keycloak::sssd`

Private class.

## Defined types

### <a name="keycloak--client_scope--oidc"></a>`keycloak::client_scope::oidc`

Manage Keycloak OpenID Connect client scope using built-in mappers

#### Examples

##### 

```puppet
keycloak::client_scope::oidc { 'oidc-clients':
  realm => 'test',
}
```

#### Parameters

The following parameters are available in the `keycloak::client_scope::oidc` defined type:

* [`realm`](#-keycloak--client_scope--oidc--realm)
* [`resource_name`](#-keycloak--client_scope--oidc--resource_name)

##### <a name="-keycloak--client_scope--oidc--realm"></a>`realm`

Data type: `String`

Realm of the client scope.

##### <a name="-keycloak--client_scope--oidc--resource_name"></a>`resource_name`

Data type: `String`

Name of the client scope resource

Default value: `$name`

### <a name="keycloak--client_scope--saml"></a>`keycloak::client_scope::saml`

Manage Keycloak SAML client scope using built-in mappers

#### Examples

##### 

```puppet
keycloak::client_scope::saml { 'saml-clients':
  realm => 'test',
}
```

#### Parameters

The following parameters are available in the `keycloak::client_scope::saml` defined type:

* [`realm`](#-keycloak--client_scope--saml--realm)
* [`resource_name`](#-keycloak--client_scope--saml--resource_name)

##### <a name="-keycloak--client_scope--saml--realm"></a>`realm`

Data type: `String`

Realm of the client scope.

##### <a name="-keycloak--client_scope--saml--resource_name"></a>`resource_name`

Data type: `String`

Name of the client scope resource

Default value: `$name`

### <a name="keycloak--freeipa_ldap_mappers"></a>`keycloak::freeipa_ldap_mappers`

setup FreeIPA LDAP mappers for Keycloak

#### Examples

##### 

```puppet
keycloak::freeipa_ldap_mappers { 'ipa.example.org':
  realm            => 'EXAMPLE.ORG',
  groups_dn        => 'cn=groups,cn=accounts,dc=example,dc=org',
  roles_dn         => 'cn=groups,cn=accounts,dc=example,dc=org'
}
```

#### Parameters

The following parameters are available in the `keycloak::freeipa_ldap_mappers` defined type:

* [`realm`](#-keycloak--freeipa_ldap_mappers--realm)
* [`groups_dn`](#-keycloak--freeipa_ldap_mappers--groups_dn)
* [`roles_dn`](#-keycloak--freeipa_ldap_mappers--roles_dn)
* [`parent_id`](#-keycloak--freeipa_ldap_mappers--parent_id)

##### <a name="-keycloak--freeipa_ldap_mappers--realm"></a>`realm`

Data type: `String`

Keycloak realm

##### <a name="-keycloak--freeipa_ldap_mappers--groups_dn"></a>`groups_dn`

Data type: `String`

Groups DN

##### <a name="-keycloak--freeipa_ldap_mappers--roles_dn"></a>`roles_dn`

Data type: `String`

Roles DN

##### <a name="-keycloak--freeipa_ldap_mappers--parent_id"></a>`parent_id`

Data type: `String`

Used to identify the parent LDAP user provider, name used with keycloak::freeipa_user_provider

Default value: `$title`

### <a name="keycloak--freeipa_user_provider"></a>`keycloak::freeipa_user_provider`

setup IPA as an LDAP user provider for Keycloak

#### Examples

##### Add FreeIPA as a user provider

```puppet
keycloak::freeipa_user_provider { 'ipa.example.org':
  ensure          => 'present',
  realm           => 'EXAMPLE.ORG',
  bind_dn         => 'uid=ldapproxy,cn=sysaccounts,cn=etc,dc=example,dc=org',
  bind_credential => 'secret',
  users_dn        => 'cn=users,cn=accounts,dc=example,dc=org',
  priority        => 10,
}
```

#### Parameters

The following parameters are available in the `keycloak::freeipa_user_provider` defined type:

* [`ensure`](#-keycloak--freeipa_user_provider--ensure)
* [`id`](#-keycloak--freeipa_user_provider--id)
* [`ipa_host`](#-keycloak--freeipa_user_provider--ipa_host)
* [`realm`](#-keycloak--freeipa_user_provider--realm)
* [`bind_dn`](#-keycloak--freeipa_user_provider--bind_dn)
* [`bind_credential`](#-keycloak--freeipa_user_provider--bind_credential)
* [`users_dn`](#-keycloak--freeipa_user_provider--users_dn)
* [`priority`](#-keycloak--freeipa_user_provider--priority)
* [`ldaps`](#-keycloak--freeipa_user_provider--ldaps)
* [`full_sync_period`](#-keycloak--freeipa_user_provider--full_sync_period)
* [`changed_sync_period`](#-keycloak--freeipa_user_provider--changed_sync_period)

##### <a name="-keycloak--freeipa_user_provider--ensure"></a>`ensure`

Data type: `Enum['present', 'absent']`

LDAP user provider status

Default value: `'present'`

##### <a name="-keycloak--freeipa_user_provider--id"></a>`id`

Data type: `Optional[String]`

ID to use for user provider

Default value: `undef`

##### <a name="-keycloak--freeipa_user_provider--ipa_host"></a>`ipa_host`

Data type: `Stdlib::Host`

Hostname of the FreeIPA server (e.g. ipa.example.org)

Default value: `$title`

##### <a name="-keycloak--freeipa_user_provider--realm"></a>`realm`

Data type: `String`

Keycloak realm

##### <a name="-keycloak--freeipa_user_provider--bind_dn"></a>`bind_dn`

Data type: `String`

LDAP bind dn

##### <a name="-keycloak--freeipa_user_provider--bind_credential"></a>`bind_credential`

Data type: `String`

LDAP bind password

##### <a name="-keycloak--freeipa_user_provider--users_dn"></a>`users_dn`

Data type: `String`

The DN for user search

##### <a name="-keycloak--freeipa_user_provider--priority"></a>`priority`

Data type: `Integer`

Priority for this user provider

Default value: `10`

##### <a name="-keycloak--freeipa_user_provider--ldaps"></a>`ldaps`

Data type: `Boolean`

Use LDAPS protocol instead of LDAP

Default value: `false`

##### <a name="-keycloak--freeipa_user_provider--full_sync_period"></a>`full_sync_period`

Data type: `Optional[Integer]`

Synchronize all users this often (fullSyncPeriod)

Default value: `undef`

##### <a name="-keycloak--freeipa_user_provider--changed_sync_period"></a>`changed_sync_period`

Data type: `Optional[Integer]`

Synchronize changed users this often (changedSyncPeriod)

Default value: `undef`

### <a name="keycloak--partial_import"></a>`keycloak::partial_import`

Perform partialImport using CLI

#### Examples

##### Perform partial import

```puppet
keycloak::partial_import { 'mysettings':
  realm              => 'test',
  if_resource_exists => 'SKIP',
  source             => 'puppet:///modules/profile/keycloak/mysettings.json',
}
```

#### Parameters

The following parameters are available in the `keycloak::partial_import` defined type:

* [`realm`](#-keycloak--partial_import--realm)
* [`if_resource_exists`](#-keycloak--partial_import--if_resource_exists)
* [`source`](#-keycloak--partial_import--source)
* [`content`](#-keycloak--partial_import--content)
* [`filename`](#-keycloak--partial_import--filename)
* [`require_realm`](#-keycloak--partial_import--require_realm)
* [`create_realm`](#-keycloak--partial_import--create_realm)

##### <a name="-keycloak--partial_import--realm"></a>`realm`

Data type: `String[1]`

The Keycloak Realm

##### <a name="-keycloak--partial_import--if_resource_exists"></a>`if_resource_exists`

Data type: `Enum['FAIL','SKIP','OVERWRITE']`

Behavior for when resources exist

##### <a name="-keycloak--partial_import--source"></a>`source`

Data type: `Optional[Variant[Stdlib::Filesource, Stdlib::HTTPSUrl]]`

The import JSON source

Default value: `undef`

##### <a name="-keycloak--partial_import--content"></a>`content`

Data type: `Optional[String[1]]`

The import JSON content

Default value: `undef`

##### <a name="-keycloak--partial_import--filename"></a>`filename`

Data type: `String[1]`

The filename of the stored JSON

Default value: `$name`

##### <a name="-keycloak--partial_import--require_realm"></a>`require_realm`

Data type: `Boolean`

Determines whether to require the Keycloak_realm resource

Default value: `true`

##### <a name="-keycloak--partial_import--create_realm"></a>`create_realm`

Data type: `Boolean`

Determines whether to define the Keycloak_realm resource

Default value: `false`

### <a name="keycloak--spi_deployment"></a>`keycloak::spi_deployment`

}

#### Examples

##### Add Duo SPI

```puppet
keycloak::spi_deployment { 'duo-spi':
  ensure        => 'present',
  deployed_name => 'keycloak-duo-spi-jar-with-dependencies.jar',
  source        => 'file:///path/to/source/keycloak-duo-spi-jar-with-dependencies.jar',
}
```

##### Add Duo SPI and check API for existance of resources before going onto dependenct resources

```puppet
keycloak::spi_deployment { 'duo-spi':
  deployed_name => 'keycloak-duo-spi-jar-with-dependencies.jar',
  source        => 'file:///path/to/source/keycloak-duo-spi-jar-with-dependencies.jar',
  test_url      => 'authentication/authenticator-providers',
  test_key      => 'id',
  test_value    => 'duo-mfa-authenticator',
  test_realm    => 'test',
  before        => Keycloak_flow_execution['duo-mfa-authenticator under form-browser-with-duo on test'],
```

#### Parameters

The following parameters are available in the `keycloak::spi_deployment` defined type:

* [`ensure`](#-keycloak--spi_deployment--ensure)
* [`deployed_name`](#-keycloak--spi_deployment--deployed_name)
* [`source`](#-keycloak--spi_deployment--source)
* [`test_url`](#-keycloak--spi_deployment--test_url)
* [`test_key`](#-keycloak--spi_deployment--test_key)
* [`test_value`](#-keycloak--spi_deployment--test_value)
* [`test_realm`](#-keycloak--spi_deployment--test_realm)
* [`test_before`](#-keycloak--spi_deployment--test_before)

##### <a name="-keycloak--spi_deployment--ensure"></a>`ensure`

Data type: `Enum['present', 'absent']`

State of the deployment

Default value: `'present'`

##### <a name="-keycloak--spi_deployment--deployed_name"></a>`deployed_name`

Data type: `String[1]`

Name of the file to be deployed. Defaults to `$name`.

Default value: `$name`

##### <a name="-keycloak--spi_deployment--source"></a>`source`

Data type: `Variant[Stdlib::Filesource, Stdlib::HTTPSUrl]`

Source of the deployment, supports 'file://', 'puppet://', 'https://' or 'http://'

##### <a name="-keycloak--spi_deployment--test_url"></a>`test_url`

Data type: `Optional[String]`

URL to test for existance of resources created by this SPI

Default value: `undef`

##### <a name="-keycloak--spi_deployment--test_key"></a>`test_key`

Data type: `Optional[String]`

Key of resource when testing for resource created by this SPI

Default value: `undef`

##### <a name="-keycloak--spi_deployment--test_value"></a>`test_value`

Data type: `Optional[String]`

Value of the `test_key` when testing for resources created by this SPI

Default value: `undef`

##### <a name="-keycloak--spi_deployment--test_realm"></a>`test_realm`

Data type: `Optional[String]`

Realm to query when looking for resources created by this SPI

Default value: `undef`

##### <a name="-keycloak--spi_deployment--test_before"></a>`test_before`

Data type: `Optional[Array]`

Setup autorequires for validator dependent resources

Default value: `undef`

### <a name="keycloak--truststore--host"></a>`keycloak::truststore::host`

Add host to Keycloak truststore

#### Examples

##### 

```puppet
keycloak::truststore::host { 'ldap1.example.com':
  certificate => '/etc/openldap/certs/0a00000.0',
}
```

#### Parameters

The following parameters are available in the `keycloak::truststore::host` defined type:

* [`certificate`](#-keycloak--truststore--host--certificate)
* [`ensure`](#-keycloak--truststore--host--ensure)

##### <a name="-keycloak--truststore--host--certificate"></a>`certificate`

Data type: `String`

Path to host certificate

##### <a name="-keycloak--truststore--host--ensure"></a>`ensure`

Data type: `Enum['latest', 'present', 'absent']`

Host ensure value passed to `java_ks` resource.

Default value: `'latest'`

## Resource types

### <a name="keycloak_api"></a>`keycloak_api`

Type that configures API connection parameters for other keycloak types that use the Keycloak API.

#### Examples

##### Define API access

```puppet
keycloak_api { 'keycloak'
  install_dir  => '/opt/keycloak',
  server       => 'http://localhost:8080',
  realm        => 'master',
  user         => 'admin',
  password     => 'changeme',
}
```

#### Parameters

The following parameters are available in the `keycloak_api` type.

* [`install_dir`](#-keycloak_api--install_dir)
* [`keycloak_group`](#-keycloak_api--keycloak_group)
* [`keycloak_user`](#-keycloak_api--keycloak_user)
* [`name`](#-keycloak_api--name)
* [`password`](#-keycloak_api--password)
* [`realm`](#-keycloak_api--realm)
* [`server`](#-keycloak_api--server)
* [`use_wrapper`](#-keycloak_api--use_wrapper)
* [`user`](#-keycloak_api--user)

##### <a name="-keycloak_api--install_dir"></a>`install_dir`

Install location of Keycloak

Default value: `/opt/keycloak`

##### <a name="-keycloak_api--keycloak_group"></a>`keycloak_group`

Keycloak group

Default value: `keycloak`

##### <a name="-keycloak_api--keycloak_user"></a>`keycloak_user`

Keycloak user

Default value: `keycloak`

##### <a name="-keycloak_api--name"></a>`name`

namevar

Keycloak API config

##### <a name="-keycloak_api--password"></a>`password`

Password for authentication

Default value: `changeme`

##### <a name="-keycloak_api--realm"></a>`realm`

Realm for authentication

Default value: `master`

##### <a name="-keycloak_api--server"></a>`server`

Auth URL for Keycloak server

Default value: `http://localhost:8080`

##### <a name="-keycloak_api--use_wrapper"></a>`use_wrapper`

Valid values: `true`, `false`

Boolean that determines if kcadm_wrapper.sh should be used

Default value: `false`

##### <a name="-keycloak_api--user"></a>`user`

User for authentication

Default value: `admin`

### <a name="keycloak_client"></a>`keycloak_client`

Manage Keycloak clients

#### Examples

##### Add a OpenID Connect client

```puppet
keycloak_client { 'www.example.com':
  ensure                => 'present',
  realm                 => 'test',
  redirect_uris         => [
    "https://www.example.com/oidc",
    "https://www.example.com",
  ],
  default_client_scopes => ['profile','email'],
  secret                => 'supersecret',
}
```

#### Properties

The following properties are available in the `keycloak_client` type.

##### `access_token_lifespan`

access.token.lifespan

##### `admin_url`

adminUrl

##### `authorization_services_enabled`

Valid values: `true`, `false`

authorizationServicesEnabled

Default value: `false`

##### `backchannel_logout_url`

backchannel.logout.url

##### `base_url`

baseUrl

##### `bearer_only`

Valid values: `true`, `false`

bearerOnly

Default value: `false`

##### `browser_flow`

authenticationFlowBindingOverrides.browser (Use flow alias, not ID)

Default value: `absent`

##### `client_authenticator_type`

clientAuthenticatorType

Default value: `client-secret`

##### `default_client_scopes`

defaultClientScopes

Default value: `[]`

##### `direct_access_grants_enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `direct_grant_flow`

authenticationFlowBindingOverrides.direct_grant (Use flow alias, not ID)

Default value: `absent`

##### `enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `full_scope_allowed`

Valid values: `true`, `false`

fullScopeAllowed

Default value: `true`

##### `implicit_flow_enabled`

Valid values: `true`, `false`

implicitFlowEnabled

Default value: `false`

##### `login_theme`

login_theme

Default value: `absent`

##### `optional_client_scopes`

optionalClientScopes

Default value: `[]`

##### `protocol`

Valid values: `openid-connect`, `saml`

protocol

Default value: `openid-connect`

##### `public_client`

Valid values: `true`, `false`

enabled

Default value: `false`

##### `redirect_uris`

redirectUris

Default value: `[]`

##### `roles`

roles

Default value: `[]`

##### `root_url`

rootUrl

##### `saml_artifact_binding_url`

saml_artifact_binding_url

##### `saml_assertion_consumer_url_post`

saml_assertion_consumer_url_post

##### `saml_assertion_signature`

saml.assertion.signature

##### `saml_client_signature`

saml.client.signature

##### `saml_encrypt`

saml.encrypt

##### `saml_encryption_certificate`

saml.encryption.certificate

##### `saml_name_id_format`

saml_name_id_format

##### `saml_signing_certificate`

saml.signing.certificate

##### `saml_signing_private_key`

saml.signing.private.key

##### `saml_single_logout_service_url_redirect`

saml_single_logout_service_url_redirect

##### `secret`

secret

##### `service_accounts_enabled`

Valid values: `true`, `false`

serviceAccountsEnabled

Default value: `false`

##### `standard_flow_enabled`

Valid values: `true`, `false`

standardFlowEnabled

Default value: `true`

##### `web_origins`

webOrigins

#### Parameters

The following parameters are available in the `keycloak_client` type.

* [`client_id`](#-keycloak_client--client_id)
* [`id`](#-keycloak_client--id)
* [`name`](#-keycloak_client--name)
* [`provider`](#-keycloak_client--provider)
* [`realm`](#-keycloak_client--realm)

##### <a name="-keycloak_client--client_id"></a>`client_id`

clientId. Defaults to `name`.

##### <a name="-keycloak_client--id"></a>`id`

Id. Defaults to `client_id`

##### <a name="-keycloak_client--name"></a>`name`

namevar

The client name

##### <a name="-keycloak_client--provider"></a>`provider`

The specific backend to use for this `keycloak_client` resource. You will seldom need to specify this --- Puppet will
usually discover the appropriate provider for your platform.

##### <a name="-keycloak_client--realm"></a>`realm`

realm

### <a name="keycloak_client_protocol_mapper"></a>`keycloak_client_protocol_mapper`

Manage Keycloak protocol mappers

#### Examples

##### Add email protocol mapper to test.example.com client in realm test

```puppet
keycloak_client_protocol_mapper { "email for test.example.com on test":
  claim_name     => 'email',
  user_attribute => 'email',
}
```

#### Properties

The following properties are available in the `keycloak_client_protocol_mapper` type.

##### `access_token_claim`

Valid values: `true`, `false`

access.token.claim. Default to `true` for `protocol` `openid-connect`.

##### `attribute_name`

attribute.name Default to `resource_name` for `type` `saml-user-property-mapper`.

##### `attribute_nameformat`

attribute.nameformat

##### `claim_name`

claim.name

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `friendly_name`

friendly.name. Default to `resource_name` for `type` `saml-user-property-mapper`.

##### `full_path`

Valid values: `true`, `false`

full.path. Default to `false` for `type` `oidc-group-membership-mapper`.

##### `id_token_claim`

Valid values: `true`, `false`

id.token.claim. Default to `true` for `protocol` `openid-connect`.

##### `included_client_audience`

included.client.audience Required for `type` of `oidc-audience-mapper`

##### `json_type_label`

json.type.label. Default to `String` for `type` `oidc-usermodel-property-mapper` and `oidc-group-membership-mapper`.

##### `multivalued`

Valid values: `true`, `false`

multivalued

##### `protocol`

Valid values: `openid-connect`, `saml`

protocol

Default value: `openid-connect`

##### `single`

Valid values: `true`, `false`

single. Default to `false` for `type` `saml-role-list-mapper`.

##### `user_attribute`

user.attribute. Default to `resource_name` for `type` `oidc-usermodel-property-mapper` or `saml-user-property-mapper`

##### `userinfo_token_claim`

Valid values: `true`, `false`

userinfo.token.claim. Default to `true` for `protocol` `openid-connect` except `type` of `oidc-audience-mapper`.

##### `usermodel_client_role_mapping_client_id`

usermodel.clientRoleMapping.clientId for `type` `oidc-usermodel-client-role-mapper`

#### Parameters

The following parameters are available in the `keycloak_client_protocol_mapper` type.

* [`client`](#-keycloak_client_protocol_mapper--client)
* [`id`](#-keycloak_client_protocol_mapper--id)
* [`name`](#-keycloak_client_protocol_mapper--name)
* [`provider`](#-keycloak_client_protocol_mapper--provider)
* [`realm`](#-keycloak_client_protocol_mapper--realm)
* [`resource_name`](#-keycloak_client_protocol_mapper--resource_name)
* [`type`](#-keycloak_client_protocol_mapper--type)

##### <a name="-keycloak_client_protocol_mapper--client"></a>`client`

client

##### <a name="-keycloak_client_protocol_mapper--id"></a>`id`

Id.

##### <a name="-keycloak_client_protocol_mapper--name"></a>`name`

namevar

The protocol mapper name

##### <a name="-keycloak_client_protocol_mapper--provider"></a>`provider`

The specific backend to use for this `keycloak_client_protocol_mapper` resource. You will seldom need to specify this
--- Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_client_protocol_mapper--realm"></a>`realm`

realm

##### <a name="-keycloak_client_protocol_mapper--resource_name"></a>`resource_name`

The protocol mapper name. Defaults to `name`.

##### <a name="-keycloak_client_protocol_mapper--type"></a>`type`

Valid values: `oidc-usermodel-client-role-mapper`, `oidc-usermodel-property-mapper`, `oidc-full-name-mapper`, `oidc-group-membership-mapper`, `oidc-audience-mapper`, `saml-user-property-mapper`, `saml-role-list-mapper`

protocolMapper.

Default is `oidc-usermodel-property-mapper` for `protocol` `openid-connect` and
`saml-user-property-mapper` for `protocol` `saml`.

### <a name="keycloak_client_scope"></a>`keycloak_client_scope`

Manage Keycloak client scopes

#### Examples

##### Define a OpenID Connect client scope in the test realm

```puppet
keycloak_client_scope { 'email on test':
  protocol => 'openid-connect',
}
```

#### Properties

The following properties are available in the `keycloak_client_scope` type.

##### `consent_screen_text`

consent.screen.text

##### `display_on_consent_screen`

Valid values: `true`, `false`

display.on.consent.screen

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `include_in_token_scope`

Valid values: `true`, `false`

include.in.token.scope

##### `protocol`

Valid values: `openid-connect`, `saml`

protocol

Default value: `openid-connect`

#### Parameters

The following parameters are available in the `keycloak_client_scope` type.

* [`id`](#-keycloak_client_scope--id)
* [`name`](#-keycloak_client_scope--name)
* [`provider`](#-keycloak_client_scope--provider)
* [`realm`](#-keycloak_client_scope--realm)
* [`resource_name`](#-keycloak_client_scope--resource_name)

##### <a name="-keycloak_client_scope--id"></a>`id`

Id. Defaults to `resource_name`.

##### <a name="-keycloak_client_scope--name"></a>`name`

namevar

The client scope name

##### <a name="-keycloak_client_scope--provider"></a>`provider`

The specific backend to use for this `keycloak_client_scope` resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_client_scope--realm"></a>`realm`

realm

##### <a name="-keycloak_client_scope--resource_name"></a>`resource_name`

The client scope name. Defaults to `name`.

### <a name="keycloak_conn_validator"></a>`keycloak_conn_validator`

Verify that a connection can be successfully established between a node
and the keycloak server.  Its primary use is as a precondition to
prevent configuration changes from being applied if the keycloak
server cannot be reached, but it could potentially be used for other
purposes such as monitoring.

#### Properties

The following properties are available in the `keycloak_conn_validator` type.

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

#### Parameters

The following parameters are available in the `keycloak_conn_validator` type.

* [`keycloak_port`](#-keycloak_conn_validator--keycloak_port)
* [`keycloak_server`](#-keycloak_conn_validator--keycloak_server)
* [`name`](#-keycloak_conn_validator--name)
* [`provider`](#-keycloak_conn_validator--provider)
* [`relative_path`](#-keycloak_conn_validator--relative_path)
* [`test_url`](#-keycloak_conn_validator--test_url)
* [`timeout`](#-keycloak_conn_validator--timeout)
* [`use_ssl`](#-keycloak_conn_validator--use_ssl)

##### <a name="-keycloak_conn_validator--keycloak_port"></a>`keycloak_port`

The port that the keycloak server should be listening on.

Default value: `8080`

##### <a name="-keycloak_conn_validator--keycloak_server"></a>`keycloak_server`

The DNS name or IP address of the server where keycloak should be running.

Default value: `localhost`

##### <a name="-keycloak_conn_validator--name"></a>`name`

namevar

An arbitrary name used as the identity of the resource.

##### <a name="-keycloak_conn_validator--provider"></a>`provider`

The specific backend to use for this `keycloak_conn_validator` resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_conn_validator--relative_path"></a>`relative_path`

URL relative path that is used by Keycloak

Default value: `/`

##### <a name="-keycloak_conn_validator--test_url"></a>`test_url`

URL to use for testing if the Keycloak database is up

Default value: `/realms/master/.well-known/openid-configuration`

##### <a name="-keycloak_conn_validator--timeout"></a>`timeout`

The max number of seconds that the validator should wait before giving up and deciding that keycloak is not running;
defaults to 15 seconds.

Default value: `30`

##### <a name="-keycloak_conn_validator--use_ssl"></a>`use_ssl`

Whether the connection will be attemped using https

Default value: `false`

### <a name="keycloak_flow"></a>`keycloak_flow`

Manage a Keycloak flow
**Autorequires**
* `keycloak_realm` defined for `realm` parameter
* `keycloak_flow` of `flow_alias` if `top_level=false`
* `keycloak_flow` of `flow_alias` if other `priority` is lower and if `top_level=false`
* `keycloak_flow_execution` if `flow_alias` is the same and other `priority` is lower and if `top_level=false`

#### Examples

##### Add custom flow

```puppet
keycloak_flow { 'browser-with-duo':
  ensure => 'present',
  realm  => 'test',
}
```

##### Add a flow execution to existing browser-with-duo flow

```puppet
keycloak_flow { 'form-browser-with-duo under browser-with-duo on test':
  ensure      => 'present',
  priority    => 20,
  requirement => 'ALTERNATIVE',
  top_level   => false,
}
```

#### Properties

The following properties are available in the `keycloak_flow` type.

##### `description`

description

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `priority`

execution priority, only applied to top_level=false, required for top_level=false

##### `requirement`

Valid values: `DISABLED`, `ALTERNATIVE`, `REQUIRED`, `CONDITIONAL`, `disabled`, `alternative`, `required`, `conditional`

requirement, only applied to top_level=false and defaults to DISABLED

#### Parameters

The following parameters are available in the `keycloak_flow` type.

* [`alias`](#-keycloak_flow--alias)
* [`flow_alias`](#-keycloak_flow--flow_alias)
* [`id`](#-keycloak_flow--id)
* [`name`](#-keycloak_flow--name)
* [`provider`](#-keycloak_flow--provider)
* [`provider_id`](#-keycloak_flow--provider_id)
* [`realm`](#-keycloak_flow--realm)
* [`top_level`](#-keycloak_flow--top_level)
* [`type`](#-keycloak_flow--type)

##### <a name="-keycloak_flow--alias"></a>`alias`

Alias. Default to `name`.

##### <a name="-keycloak_flow--flow_alias"></a>`flow_alias`

flowAlias, required for top_level=false

##### <a name="-keycloak_flow--id"></a>`id`

Id. Default to `$alias-$realm` when top_level is true. Only applies to top_level=true

##### <a name="-keycloak_flow--name"></a>`name`

namevar

The flow name

##### <a name="-keycloak_flow--provider"></a>`provider`

The specific backend to use for this `keycloak_flow` resource. You will seldom need to specify this --- Puppet will
usually discover the appropriate provider for your platform.

##### <a name="-keycloak_flow--provider_id"></a>`provider_id`

Valid values: `basic-flow`, `form-flow`

providerId

Default value: `basic-flow`

##### <a name="-keycloak_flow--realm"></a>`realm`

realm

##### <a name="-keycloak_flow--top_level"></a>`top_level`

Valid values: `true`, `false`

topLevel

Default value: `true`

##### <a name="-keycloak_flow--type"></a>`type`

sub-flow execution provider, default to `registration-page-form` for top_level=false and does not apply to
top_level=true

### <a name="keycloak_flow_execution"></a>`keycloak_flow_execution`

Manage a Keycloak flow
**Autorequires**
* `keycloak_realm` defined for `realm` parameter
* `keycloak_flow` of value defined for `flow_alias`
* `keycloak_flow` if they share same `flow_alias` value and the other resource `priority` is lower
* `keycloak_flow_execution` if `flow_alias` is the same and other `priority` is lower

#### Examples

##### Add an execution to a flow

```puppet
keycloak_flow_execution { 'auth-cookie under browser-with-duo on test':
  ensure       => 'present',
  configurable => false,
  display_name => 'Cookie',
  priority     => 10,
  requirement  => 'ALTERNATIVE',
}
```

##### Add an execution to a execution flow that is one level deeper than top level

```puppet
keycloak_flow_execution { 'auth-username-password-form under form-browser-with-duo on test':
  ensure       => 'present',
  configurable => false,
  display_name => 'Username Password Form',
  priority     => 10,
  requirement  => 'REQUIRED',
}
```

##### Add an execution with a configuration

```puppet
keycloak_flow_execution { 'duo-mfa-authenticator under form-browser-with-duo on test':
  ensure       => 'present',
  configurable => true,
  display_name => 'Duo MFA',
  alias        => 'Duo',
  config       => {
    "duomfa.akey"    => "foo-akey",
    "duomfa.apihost" => "api-foo.duosecurity.com",
    "duomfa.skey"    => "secret",
    "duomfa.ikey"    => "foo-ikey",
    "duomfa.groups"  => "duo"
  },
  requirement  => 'REQUIRED',
  priority     => 20,
}
```

#### Properties

The following properties are available in the `keycloak_flow_execution` type.

##### `config`

execution config

##### `configurable`

Valid values: `true`, `false`

configurable

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `priority`

execution priority

##### `requirement`

Valid values: `DISABLED`, `ALTERNATIVE`, `REQUIRED`, `CONDITIONAL`, `disabled`, `alternative`, `required`, `conditional`

requirement

Default value: `DISABLED`

#### Parameters

The following parameters are available in the `keycloak_flow_execution` type.

* [`alias`](#-keycloak_flow_execution--alias)
* [`config_id`](#-keycloak_flow_execution--config_id)
* [`display_name`](#-keycloak_flow_execution--display_name)
* [`flow_alias`](#-keycloak_flow_execution--flow_alias)
* [`id`](#-keycloak_flow_execution--id)
* [`name`](#-keycloak_flow_execution--name)
* [`provider`](#-keycloak_flow_execution--provider)
* [`provider_id`](#-keycloak_flow_execution--provider_id)
* [`realm`](#-keycloak_flow_execution--realm)

##### <a name="-keycloak_flow_execution--alias"></a>`alias`

alias

##### <a name="-keycloak_flow_execution--config_id"></a>`config_id`

read-only config ID

##### <a name="-keycloak_flow_execution--display_name"></a>`display_name`

displayName

##### <a name="-keycloak_flow_execution--flow_alias"></a>`flow_alias`

flowAlias

##### <a name="-keycloak_flow_execution--id"></a>`id`

read-only Id

##### <a name="-keycloak_flow_execution--name"></a>`name`

namevar

The flow execution name

##### <a name="-keycloak_flow_execution--provider"></a>`provider`

The specific backend to use for this `keycloak_flow_execution` resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_flow_execution--provider_id"></a>`provider_id`

provider

##### <a name="-keycloak_flow_execution--realm"></a>`realm`

realm

### <a name="keycloak_identity_provider"></a>`keycloak_identity_provider`

Manage Keycloak identity providers

#### Examples

##### Add CILogon identity provider to test realm

```puppet
keycloak_identity_provider { 'cilogon on test':
  ensure                         => 'present',
  display_name                   => 'CILogon',
  provider_id                    => 'oidc',
  first_broker_login_flow_alias  => 'browser',
  client_id                      => 'cilogon:/client_id/foobar',
  client_secret                  => 'supersecret',
  user_info_url                  => 'https://cilogon.org/oauth2/userinfo',
  token_url                      => 'https://cilogon.org/oauth2/token',
  authorization_url              => 'https://cilogon.org/authorize',
}
```

#### Properties

The following properties are available in the `keycloak_identity_provider` type.

##### `add_read_token_role_on_create`

Valid values: `true`, `false`

addReadTokenRoleOnCreate

Default value: `false`

##### `allowed_clock_skew`

allowedClockSkew

##### `authenticate_by_default`

Valid values: `true`, `false`

authenticateByDefault

Default value: `false`

##### `authorization_url`

authorizationUrl

##### `backchannel_supported`

Valid values: `true`, `false`

backchannelSupported

Default value: `false`

##### `client_auth_method`

Valid values: `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, `private_key_jwt`

clientAuthMethod

Default value: `client_secret_post`

##### `client_id`

clientId

##### `client_secret`

clientSecret

##### `default_scope`

default_scope

##### `disable_user_info`

Valid values: `true`, `false`

disableUserInfo

Default value: `false`

##### `display_name`

displayName

##### `enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `first_broker_login_flow_alias`

firstBrokerLoginFlowAlias

Default value: `first broker login`

##### `forward_parameters`

forwardParameters

##### `gui_order`

guiOrder

##### `hide_on_login_page`

Valid values: `true`, `false`

hideOnLoginPage

Default value: `false`

##### `issuer`

issuer

##### `jwks_url`

jwksUrl

##### `link_only`

Valid values: `true`, `false`

linkOnly

Default value: `false`

##### `login_hint`

Valid values: `true`, `false`

loginHint

Default value: `false`

##### `logout_url`

logoutUrl

##### `post_broker_login_flow_alias`

postBrokerLoginFlowAlias

##### `prompt`

Valid values: `none`, `consent`, `login`, `select_account`

prompt

##### `store_token`

Valid values: `true`, `false`

storeToken

Default value: `false`

##### `sync_mode`

Valid values: `IMPORT`, `LEGACY`, `FORCE`

syncMode

Default value: `IMPORT`

##### `token_url`

tokenUrl

##### `trust_email`

Valid values: `true`, `false`

trustEmail

Default value: `false`

##### `ui_locales`

Valid values: `true`, `false`

uiLocales

Default value: `false`

##### `update_profile_first_login_mode`

Valid values: `on`, `off`

updateProfileFirstLoginMode

Default value: `on`

##### `use_jwks_url`

Valid values: `true`, `false`

useJwksUrl

Default value: `true`

##### `user_info_url`

userInfoUrl

##### `validate_signature`

Valid values: `true`, `false`

validateSignature

Default value: `false`

#### Parameters

The following parameters are available in the `keycloak_identity_provider` type.

* [`alias`](#-keycloak_identity_provider--alias)
* [`internal_id`](#-keycloak_identity_provider--internal_id)
* [`name`](#-keycloak_identity_provider--name)
* [`provider`](#-keycloak_identity_provider--provider)
* [`provider_id`](#-keycloak_identity_provider--provider_id)
* [`realm`](#-keycloak_identity_provider--realm)

##### <a name="-keycloak_identity_provider--alias"></a>`alias`

The identity provider name. Defaults to `name`.

##### <a name="-keycloak_identity_provider--internal_id"></a>`internal_id`

internalId. Defaults to "`alias`-`realm`"

##### <a name="-keycloak_identity_provider--name"></a>`name`

namevar

The identity provider name

##### <a name="-keycloak_identity_provider--provider"></a>`provider`

The specific backend to use for this `keycloak_identity_provider` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_identity_provider--provider_id"></a>`provider_id`

Valid values: `oidc`, `keycloak-oidc`

providerId

Default value: `oidc`

##### <a name="-keycloak_identity_provider--realm"></a>`realm`

realm

### <a name="keycloak_ldap_mapper"></a>`keycloak_ldap_mapper`

Manage Keycloak LDAP attribute mappers

#### Examples

##### Add full name attribute mapping

```puppet
keycloak_ldap_mapper { 'full name for LDAP-test on test:
  ensure         => 'present',
  type           => 'full-name-ldap-mapper',
  ldap_attribute => 'gecos',
}
```

#### Properties

The following properties are available in the `keycloak_ldap_mapper` type.

##### `always_read_value_from_ldap`

Valid values: `true`, `false`

always.read.value.from.ldap. Defaults to `true` if `type` is `user-attribute-ldap-mapper`.

##### `client_id`

client.id, only for `type` of `role-ldap-mapper`

##### `drop_non_existing_groups_during_sync`

Valid values: `true`, `false`

drop.non.existing.groups.during.sync, only for `type` of `group-ldap-mapper`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `group_name_ldap_attribute`

group.name.ldap.attribute, only for `type` of `group-ldap-mapper`

##### `group_object_classes`

group.object.classes, only for `type` of `group-ldap-mapper`

##### `groups_dn`

groups.dn, only for `type` of `group-ldap-mapper`

##### `groups_ldap_filter`

groups.ldap.filter, only for `type` of `group-ldap-mapper`

##### `ignore_missing_groups`

Valid values: `true`, `false`

ignore.missing.groups, only for `type` of `group-ldap-mapper`

##### `is_mandatory_in_ldap`

is.mandatory.in.ldap. Defaults to `false` unless `type` is `full-name-ldap-mapper`.

##### `ldap_attribute`

ldap.attribute

##### `mapped_group_attributes`

mapped.group.attributes, only for `type` of `group-ldap-mapper`

Default value: `absent`

##### `memberof_ldap_attribute`

memberof.ldap.attribute, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `membership_attribute_type`

Valid values: `DN`, `UID`

membership.attribute.type, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `membership_ldap_attribute`

membership.ldap.attribute, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `membership_user_ldap_attribute`

membership.user.ldap.attribute, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `mode`

Valid values: `READ_ONLY`, `LDAP_ONLY`

mode, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `preserve_group_inheritance`

Valid values: `true`, `false`

preserve.group.inheritance, only for `type` of `group-ldap-mapper`

##### `read_only`

Valid values: `true`, `false`

read.only

##### `role_name_ldap_attribute`

role.name.ldap.attribute, only for `type` of `role-ldap-mapper`

##### `role_object_classes`

role.object.classes, only for `type` of `role-ldap-mapper`

##### `roles_dn`

roles.dn, only for `type` of `role-ldap-mapper`

##### `roles_ldap_filter`

roles.ldap.filter, only for `type` of `role-ldap-mapper`

##### `use_realm_roles_mapping`

Valid values: `true`, `false`

use.realm.roles.mapping, only for `type` of `role-ldap-mapper`

##### `user_model_attribute`

user.model.attribute

##### `user_roles_retrieve_strategy`

Valid values: `LOAD_GROUPS_BY_MEMBER_ATTRIBUTE`, `GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE`, `LOAD_GROUPS_BY_MEMBER_ATTRIBUTE_RECURSIVELY`, `LOAD_ROLES_BY_MEMBER_ATTRIBUTE`, `GET_ROLES_FROM_USER_MEMBEROF_ATTRIBUTE`, `LOAD_ROLES_BY_MEMBER_ATTRIBUTE_RECURSIVELY`

user.roles.retrieve.strategy, only for `type` of `group-ldap-mapper` and `role-ldap-mapper`

##### `write_only`

Valid values: `true`, `false`

write.only.  Defaults to `false` if `type` is `full-name-ldap-mapper`.

#### Parameters

The following parameters are available in the `keycloak_ldap_mapper` type.

* [`id`](#-keycloak_ldap_mapper--id)
* [`ldap`](#-keycloak_ldap_mapper--ldap)
* [`name`](#-keycloak_ldap_mapper--name)
* [`parent_id`](#-keycloak_ldap_mapper--parent_id)
* [`provider`](#-keycloak_ldap_mapper--provider)
* [`realm`](#-keycloak_ldap_mapper--realm)
* [`resource_name`](#-keycloak_ldap_mapper--resource_name)
* [`type`](#-keycloak_ldap_mapper--type)

##### <a name="-keycloak_ldap_mapper--id"></a>`id`

Id.

##### <a name="-keycloak_ldap_mapper--ldap"></a>`ldap`

Name of parent `keycloak_ldap_user_provider` resource

##### <a name="-keycloak_ldap_mapper--name"></a>`name`

namevar

The LDAP mapper name

##### <a name="-keycloak_ldap_mapper--parent_id"></a>`parent_id`

parentId

##### <a name="-keycloak_ldap_mapper--provider"></a>`provider`

The specific backend to use for this `keycloak_ldap_mapper` resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_ldap_mapper--realm"></a>`realm`

realm

##### <a name="-keycloak_ldap_mapper--resource_name"></a>`resource_name`

The LDAP mapper name. Defaults to `name`

##### <a name="-keycloak_ldap_mapper--type"></a>`type`

Valid values: `user-attribute-ldap-mapper`, `full-name-ldap-mapper`, `group-ldap-mapper`, `role-ldap-mapper`

providerId

Default value: `user-attribute-ldap-mapper`

### <a name="keycloak_ldap_user_provider"></a>`keycloak_ldap_user_provider`

Manage Keycloak LDAP user providers

#### Examples

##### Add LDAP user provider to test realm

```puppet
keycloak_ldap_user_provider { 'LDAP on test':
  ensure             => 'present',
  users_dn           => 'ou=People,dc=example,dc=com',
  connection_url     => 'ldaps://ldap1.example.com:636 ldaps://ldap2.example.com:636',
  import_enabled     => false,
  use_truststore_spi => 'never',
}
```

#### Properties

The following properties are available in the `keycloak_ldap_user_provider` type.

##### `allow_kerberos_authentication`

Valid values: `true`, `false`

allowKerberosAuthentication

##### `auth_type`

Valid values: `none`, `simple`

authType

Default value: `none`

##### `batch_size_for_sync`

batchSizeForSync

Default value: `1000`

##### `bind_credential`

bindCredential

##### `bind_dn`

bindDn

##### `cache_policy`

Valid values: `DEFAULT`, `EVICT_DAILY`, `EVICT_WEEKLY`, `MAX_LIFESPAN`, `NO_CACHE`

cachePolicy

Default value: `DEFAULT`

##### `changed_sync_period`

changedSyncPeriod

Default value: `-1`

##### `connection_url`

connectionUrl

##### `custom_user_search_filter`

Valid values: `%r{.*}`, `absent`

customUserSearchFilter

Default value: `absent`

##### `edit_mode`

Valid values: `READ_ONLY`, `WRITABLE`, `UNSYNCED`

editMode

Default value: `READ_ONLY`

##### `enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `full_sync_period`

fullSyncPeriod

Default value: `-1`

##### `import_enabled`

Valid values: `true`, `false`

importEnabled

Default value: `true`

##### `kerberos_realm`

kerberosRealm

##### `key_tab`

keyTab

##### `priority`

priority

Default value: `0`

##### `rdn_ldap_attribute`

rdnLdapAttribute

Default value: `uid`

##### `search_scope`

Valid values: `one`, `one_level`, `subtree`, `1`, `2`, `1`, `2`

searchScope

##### `server_principal`

serverPrincipal

##### `sync_registrations`

Valid values: `true`, `false`

syncRegistrations

Default value: `false`

##### `trust_email`

Valid values: `true`, `false`

trustEmail

Default value: `false`

##### `use_kerberos_for_password_authentication`

Valid values: `true`, `false`

useKerberosForPasswordAuthentication

##### `use_truststore_spi`

Valid values: `always`, `never`

useTruststoreSpi

Default value: `always`

##### `user_object_classes`

userObjectClasses

Default value: `['inetOrgPerson', 'organizationalPerson']`

##### `username_ldap_attribute`

usernameLdapAttribute

Default value: `uid`

##### `users_dn`

usersDn

##### `uuid_ldap_attribute`

uuidLdapAttribute

Default value: `entryUUID`

##### `vendor`

Valid values: `ad`, `rhds`, `tivoli`, `eDirectory`, `other`

vendor

Default value: `other`

#### Parameters

The following parameters are available in the `keycloak_ldap_user_provider` type.

* [`id`](#-keycloak_ldap_user_provider--id)
* [`name`](#-keycloak_ldap_user_provider--name)
* [`provider`](#-keycloak_ldap_user_provider--provider)
* [`realm`](#-keycloak_ldap_user_provider--realm)
* [`resource_name`](#-keycloak_ldap_user_provider--resource_name)

##### <a name="-keycloak_ldap_user_provider--id"></a>`id`

Id

##### <a name="-keycloak_ldap_user_provider--name"></a>`name`

namevar

The LDAP user provider name

##### <a name="-keycloak_ldap_user_provider--provider"></a>`provider`

The specific backend to use for this `keycloak_ldap_user_provider` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_ldap_user_provider--realm"></a>`realm`

parentId

##### <a name="-keycloak_ldap_user_provider--resource_name"></a>`resource_name`

The LDAP user provider name. Defaults to `name`.

### <a name="keycloak_protocol_mapper"></a>`keycloak_protocol_mapper`

Manage Keycloak client scope protocol mappers

#### Examples

##### Add email protocol mapper to oidc-client client scope in realm test

```puppet
keycloak_protocol_mapper { "email for oidc-clients on test":
  claim_name     => 'email',
  user_attribute => 'email',
}
```

#### Properties

The following properties are available in the `keycloak_protocol_mapper` type.

##### `access_token_claim`

Valid values: `true`, `false`

access.token.claim. Default to `true` for `protocol` `openid-connect`.

##### `attribute_name`

attribute.name Default to `resource_name` for `type` `saml-user-property-mapper`.

##### `attribute_nameformat`

attribute.nameformat

##### `claim_name`

claim.name

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `friendly_name`

friendly.name. Default to `resource_name` for `type` `saml-user-property-mapper`.

##### `full_path`

Valid values: `true`, `false`

full.path. Default to `false` for `type` `oidc-group-membership-mapper`.

##### `id_token_claim`

Valid values: `true`, `false`

id.token.claim. Default to `true` for `protocol` `openid-connect`.

##### `included_client_audience`

included.client.audience Required for `type` of `oidc-audience-mapper`

##### `json_type_label`

json.type.label. Default to `String` for `type` `oidc-usermodel-property-mapper` and `oidc-group-membership-mapper`.

##### `multivalued`

Valid values: `true`, `false`

multivalued

##### `protocol`

Valid values: `openid-connect`, `saml`

protocol

Default value: `openid-connect`

##### `single`

Valid values: `true`, `false`

single. Default to `false` for `type` `saml-role-list-mapper`.

##### `user_attribute`

user.attribute. Default to `resource_name` for `type` `oidc-usermodel-property-mapper` or `saml-user-property-mapper`

##### `userinfo_token_claim`

Valid values: `true`, `false`

userinfo.token.claim. Default to `true` for `protocol` `openid-connect` except `type` of `oidc-audience-mapper`.

#### Parameters

The following parameters are available in the `keycloak_protocol_mapper` type.

* [`client_scope`](#-keycloak_protocol_mapper--client_scope)
* [`id`](#-keycloak_protocol_mapper--id)
* [`name`](#-keycloak_protocol_mapper--name)
* [`provider`](#-keycloak_protocol_mapper--provider)
* [`realm`](#-keycloak_protocol_mapper--realm)
* [`resource_name`](#-keycloak_protocol_mapper--resource_name)
* [`type`](#-keycloak_protocol_mapper--type)

##### <a name="-keycloak_protocol_mapper--client_scope"></a>`client_scope`

client scope

##### <a name="-keycloak_protocol_mapper--id"></a>`id`

Id.

##### <a name="-keycloak_protocol_mapper--name"></a>`name`

namevar

The protocol mapper name

##### <a name="-keycloak_protocol_mapper--provider"></a>`provider`

The specific backend to use for this `keycloak_protocol_mapper` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_protocol_mapper--realm"></a>`realm`

realm

##### <a name="-keycloak_protocol_mapper--resource_name"></a>`resource_name`

The protocol mapper name. Defaults to `name`.

##### <a name="-keycloak_protocol_mapper--type"></a>`type`

Valid values: `oidc-usermodel-property-mapper`, `oidc-usermodel-attribute-mapper`, `oidc-full-name-mapper`, `oidc-group-membership-mapper`, `oidc-audience-mapper`, `saml-group-membership-mapper`, `saml-user-property-mapper`, `saml-user-attribute-mapper`, `saml-role-list-mapper`

protocolMapper.

Default is `oidc-usermodel-property-mapper` for `protocol` `openid-connect` and
`saml-user-property-mapper` for `protocol` `saml`.

### <a name="keycloak_realm"></a>`keycloak_realm`

Manage Keycloak realms

#### Examples

##### Add a realm with a custom theme

```puppet
keycloak_realm { 'test':
  ensure                   => 'present',
  remember_me              => true,
  login_with_email_allowed => false,
  login_theme              => 'my_theme',
}
```

#### Properties

The following properties are available in the `keycloak_realm` type.

##### `access_code_lifespan`

accessCodeLifespan

##### `access_code_lifespan_login`

accessCodeLifespanLogin

##### `access_code_lifespan_user_action`

accessCodeLifespanUserAction

##### `access_token_lifespan`

accessTokenLifespan

##### `access_token_lifespan_for_implicit_flow`

accessTokenLifespanForImplicitFlow

##### `account_theme`

accountTheme

Default value: `keycloak`

##### `action_token_generated_by_admin_lifespan`

actionTokenGeneratedByAdminLifespan

##### `action_token_generated_by_user_lifespan`

actionTokenGeneratedByUserLifespan

##### `admin_events_details_enabled`

Valid values: `true`, `false`

adminEventsDetailsEnabled

Default value: `false`

##### `admin_events_enabled`

Valid values: `true`, `false`

adminEventsEnabled

Default value: `false`

##### `admin_theme`

adminTheme

Default value: `keycloak`

##### `browser_flow`

browserFlow

Default value: `browser`

##### `brute_force_protected`

Valid values: `true`, `false`

bruteForceProtected

##### `client_authentication_flow`

clientAuthenticationFlow

Default value: `clients`

##### `content_security_policy`

contentSecurityPolicy

Default value: `frame-src 'self'; frame-ancestors 'self'; object-src 'none';`

##### `custom_properties`

custom properties to pass as realm configurations

##### `default_client_scopes`

Default Client Scopes

##### `default_locale`

defaultLocale

##### `direct_grant_flow`

directGrantFlow

Default value: `direct grant`

##### `display_name`

displayName

##### `display_name_html`

displayNameHtml

##### `docker_authentication_flow`

dockerAuthenticationFlow

Default value: `docker auth`

##### `duplicate_emails_allowed`

Valid values: `true`, `false`

duplicateEmailsAllowed

Default value: `false`

##### `edit_username_allowed`

Valid values: `true`, `false`

editUsernameAllowed

Default value: `false`

##### `email_theme`

emailTheme

Default value: `keycloak`

##### `enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `events_enabled`

Valid values: `true`, `false`

eventsEnabled

Default value: `false`

##### `events_expiration`

eventsExpiration

##### `events_listeners`

eventsListeners

Default value: `['jboss-logging']`

##### `failure_factor`

failureFactor

Default value: `30`

##### `internationalization_enabled`

Valid values: `true`, `false`

internationalizationEnabled

Default value: `false`

##### `login_theme`

loginTheme

Default value: `keycloak`

##### `login_with_email_allowed`

Valid values: `true`, `false`

loginWithEmailAllowed

Default value: `true`

##### `max_delta_time_seconds`

maxDeltaTimeSeconds

Default value: `43_200`

##### `max_failure_wait_seconds`

maxFailureWaitSeconds

Default value: `900`

##### `minimum_quick_login_wait_seconds`

minimumQuickLoginWaitSeconds

Default value: `60`

##### `offline_session_idle_timeout`

offlineSessionIdleTimeout

##### `offline_session_max_lifespan`

offlineSessionMaxLifespan

##### `offline_session_max_lifespan_enabled`

Valid values: `true`, `false`

offlineSessionMaxLifespanEnabled

Default value: `false`

##### `optional_client_scopes`

Optional Client Scopes

##### `otp_policy_algorithm`

Valid values: `HmacSHA1`, `HmacSHA256`, `HmacSHA512`

otpPolicyAlgorithm

Default value: `HmacSHA1`

##### `otp_policy_code_reusable`

Valid values: `true`, `false`

otpPolicyCodeReusable

Default value: `false`

##### `otp_policy_digits`

Valid values: `6`, `8`

otpPolicyDigits

Default value: `6`

##### `otp_policy_initial_counter`

otpPolicyInitialCounter

Default value: `0`

##### `otp_policy_look_ahead_window`

otpPolicyLookAheadWindow

Default value: `1`

##### `otp_policy_period`

otpPolicyPeriod

Default value: `30`

##### `otp_policy_type`

Valid values: `totp`, `hotp`

otpPolicyType

Default value: `totp`

##### `password_policy`

passwordPolicy

##### `permanent_lockout`

Valid values: `true`, `false`

permanentLockout

Default value: `false`

##### `quick_login_check_milli_seconds`

quickLoginCheckMilliSeconds

Default value: `1_000`

##### `registration_allowed`

Valid values: `true`, `false`

registrationAllowed

Default value: `false`

##### `registration_flow`

registrationFlow

Default value: `registration`

##### `remember_me`

Valid values: `true`, `false`

rememberMe

Default value: `false`

##### `reset_credentials_flow`

resetCredentialsFlow

Default value: `reset credentials`

##### `reset_password_allowed`

Valid values: `true`, `false`

resetPasswordAllowed

Default value: `false`

##### `roles`

roles

Default value: `['offline_access', 'uma_authorization']`

##### `smtp_server_auth`

Valid values: `true`, `false`

smtpServer auth

##### `smtp_server_envelope_from`

smtpServer envelope_from

##### `smtp_server_from`

smtpServer from

##### `smtp_server_from_display_name`

smtpServer fromDisplayName

##### `smtp_server_host`

smtpServer host

##### `smtp_server_password`

smtpServer password

##### `smtp_server_port`

smtpServer port

##### `smtp_server_reply_to`

smtpServer replyto

##### `smtp_server_reply_to_display_name`

smtpServer replyToDisplayName

##### `smtp_server_ssl`

Valid values: `true`, `false`

smtpServer ssl

##### `smtp_server_starttls`

Valid values: `true`, `false`

smtpServer starttls

##### `smtp_server_user`

smtpServer user

##### `ssl_required`

Valid values: `none`, `all`, `external`

sslRequired

Default value: `external`

##### `sso_session_idle_timeout`

ssoSessionIdleTimeout

##### `sso_session_idle_timeout_remember_me`

ssoSessionIdleTimeoutRememberMe

##### `sso_session_max_lifespan`

ssoSessionMaxLifespan

##### `sso_session_max_lifespan_remember_me`

ssoSessionMaxLifespanRememberMe

##### `supported_locales`

Supported Locales

##### `user_managed_access_allowed`

Valid values: `true`, `false`

userManagedAccessAllowed

Default value: `false`

##### `verify_email`

Valid values: `true`, `false`

verifyEmail

Default value: `false`

##### `wait_increment_seconds`

waitIncrementSeconds

Default value: `60`

##### `web_authn_policy_acceptable_aaguids`

webAuthnPolicyAcceptableAaguids

Default value: `[]`

##### `web_authn_policy_attestation_conveyance_preference`

Valid values: `none`, `direct`, `indirect`, `not specified`

webAuthnPolicyAttestationConveyancePreference

Default value: `not specified`

##### `web_authn_policy_authenticator_attachment`

Valid values: `platform`, `cross-platform`, `not specified`

webAuthnPolicyAuthenticatorAttachment

Default value: `not specified`

##### `web_authn_policy_avoid_same_authenticator_register`

Valid values: `true`, `false`

webAuthnPolicyAvoidSameAuthenticatorRegister

Default value: `false`

##### `web_authn_policy_create_timeout`

webAuthnPolicyCreateTimeout

Default value: `0`

##### `web_authn_policy_extra_origins`

webAuthnPolicyExtraOrigins

Default value: `[]`

##### `web_authn_policy_passwordless_acceptable_aaguids`

webAuthnPolicyPasswordlessAcceptableAaguids

Default value: `[]`

##### `web_authn_policy_passwordless_attestation_conveyance_preference`

Valid values: `none`, `direct`, `indirect`, `not specified`

webAuthnPolicyPasswordlessAttestationConveyancePreference

Default value: `not specified`

##### `web_authn_policy_passwordless_authenticator_attachment`

Valid values: `platform`, `cross-platform`, `not specified`

webAuthnPolicyPasswordlessAuthenticatorAttachment

Default value: `not specified`

##### `web_authn_policy_passwordless_avoid_same_authenticator_register`

Valid values: `true`, `false`

webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister

Default value: `false`

##### `web_authn_policy_passwordless_create_timeout`

webAuthnPolicyPasswordlessCreateTimeout

Default value: `0`

##### `web_authn_policy_passwordless_extra_origins`

webAuthnPolicyPasswordlessExtraOrigins

Default value: `[]`

##### `web_authn_policy_passwordless_require_resident_key`

Valid values: `No`, `Yes`, `not specified`

webAuthnPolicyPasswordlessRequireResidentKey

Default value: `not specified`

##### `web_authn_policy_passwordless_rp_entity_name`

webAuthnPolicyPasswordlessRpEntityName

Default value: `keycloak`

##### `web_authn_policy_passwordless_rp_id`

webAuthnPolicyPasswordlessRpId

Default value: `''`

##### `web_authn_policy_passwordless_signature_algorithms`

webAuthnPolicyPasswordlessSignatureAlgorithms

Default value: `['ES256']`

##### `web_authn_policy_passwordless_user_verification_requirement`

Valid values: `required`, `preferred`, `discouraged`, `not specified`

webAuthnPolicyPasswordlessUserVerificationRequirement

Default value: `not specified`

##### `web_authn_policy_require_resident_key`

Valid values: `No`, `Yes`, `not specified`

webAuthnPolicyRequireResidentKey

Default value: `not specified`

##### `web_authn_policy_rp_entity_name`

webAuthnPolicyRpEntityName

Default value: `keycloak`

##### `web_authn_policy_rp_id`

webAuthnPolicyRpId

Default value: `''`

##### `web_authn_policy_signature_algorithms`

webAuthnPolicySignatureAlgorithms

Default value: `['ES256']`

##### `web_authn_policy_user_verification_requirement`

Valid values: `required`, `preferred`, `discouraged`, `not specified`

webAuthnPolicyUserVerificationRequirement

Default value: `not specified`

#### Parameters

The following parameters are available in the `keycloak_realm` type.

* [`id`](#-keycloak_realm--id)
* [`manage_roles`](#-keycloak_realm--manage_roles)
* [`name`](#-keycloak_realm--name)
* [`provider`](#-keycloak_realm--provider)

##### <a name="-keycloak_realm--id"></a>`id`

Id. Default to `name`.

##### <a name="-keycloak_realm--manage_roles"></a>`manage_roles`

Valid values: `true`, `false`

Manage realm roles

Default value: `true`

##### <a name="-keycloak_realm--name"></a>`name`

namevar

The realm name

##### <a name="-keycloak_realm--provider"></a>`provider`

The specific backend to use for this `keycloak_realm` resource. You will seldom need to specify this --- Puppet will
usually discover the appropriate provider for your platform.

### <a name="keycloak_required_action"></a>`keycloak_required_action`

Manage Keycloak required actions

#### Examples

##### Enable Webauthn Register and make it default

```puppet
keycloak_required_action { 'webauthn-register on master':
  ensure       => present,
  provider_id  => 'webauthn-register',
  display_name => 'Webauthn Register',
  default      => true,
  enabled      => true,
  priority     => 1,
  config       => {
    'something' => 'true', # keep in mind that keycloak only supports strings for both keys and values
    'smth else' => '1',
  },
}

@example Minimal example to enable email verification without making it default
keycloak_required_action { 'VERIFY_EMAIL on master':
  ensure => present,
}
```

#### Properties

The following properties are available in the `keycloak_required_action` type.

##### `config`

Required action config

##### `default`

Valid values: `true`, `false`

If the required action is a default one. Default to false

Default value: `false`

##### `display_name`

Displayed name.

##### `enabled`

Valid values: `true`, `false`

If the required action is enabled. Default to true.

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `priority`

Required action priority

#### Parameters

The following parameters are available in the `keycloak_required_action` type.

* [`name`](#-keycloak_required_action--name)
* [`provider`](#-keycloak_required_action--provider)
* [`provider_id`](#-keycloak_required_action--provider_id)
* [`realm`](#-keycloak_required_action--realm)

##### <a name="-keycloak_required_action--name"></a>`name`

namevar

The required action name

##### <a name="-keycloak_required_action--provider"></a>`provider`

The specific backend to use for this `keycloak_required_action` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_required_action--provider_id"></a>`provider_id`

providerId of the required action.

##### <a name="-keycloak_required_action--realm"></a>`realm`

realm

### <a name="keycloak_resource_validator"></a>`keycloak_resource_validator`

Verify that a specific Keycloak resource is available

#### Properties

The following properties are available in the `keycloak_resource_validator` type.

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

#### Parameters

The following parameters are available in the `keycloak_resource_validator` type.

* [`dependent_resources`](#-keycloak_resource_validator--dependent_resources)
* [`name`](#-keycloak_resource_validator--name)
* [`provider`](#-keycloak_resource_validator--provider)
* [`realm`](#-keycloak_resource_validator--realm)
* [`test_key`](#-keycloak_resource_validator--test_key)
* [`test_url`](#-keycloak_resource_validator--test_url)
* [`test_value`](#-keycloak_resource_validator--test_value)
* [`timeout`](#-keycloak_resource_validator--timeout)

##### <a name="-keycloak_resource_validator--dependent_resources"></a>`dependent_resources`

Resources that should autorequire this validator, eg: Keycloak_flow_execution[foobar]

##### <a name="-keycloak_resource_validator--name"></a>`name`

namevar

An arbitrary name used as the identity of the resource.

##### <a name="-keycloak_resource_validator--provider"></a>`provider`

The specific backend to use for this `keycloak_resource_validator` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_resource_validator--realm"></a>`realm`

Realm to query

##### <a name="-keycloak_resource_validator--test_key"></a>`test_key`

Key to lookup

##### <a name="-keycloak_resource_validator--test_url"></a>`test_url`

URL to use for testing if the Keycloak database is up

##### <a name="-keycloak_resource_validator--test_value"></a>`test_value`

Value to lookup

##### <a name="-keycloak_resource_validator--timeout"></a>`timeout`

The max number of seconds that the validator should wait before giving up and deciding that keycloak is not running;
defaults to 15 seconds.

Default value: `30`

### <a name="keycloak_role_mapping"></a>`keycloak_role_mapping`

Attach realm roles to users and groups

#### Examples

##### Ensure that a user has the defined realm roles

```puppet
keycloak_role_mapping { 'john-offline_access':
  realm       => 'test',
  name        => 'john',
  realm_roles => ['offline_access'],
}
```

#### Properties

The following properties are available in the `keycloak_role_mapping` type.

##### `realm_roles`

realm roles

Default value: `[]`

#### Parameters

The following parameters are available in the `keycloak_role_mapping` type.

* [`group`](#-keycloak_role_mapping--group)
* [`name`](#-keycloak_role_mapping--name)
* [`provider`](#-keycloak_role_mapping--provider)
* [`realm`](#-keycloak_role_mapping--realm)

##### <a name="-keycloak_role_mapping--group"></a>`group`

Valid values: `true`, `false`

is this a group instead of a user

Default value: `false`

##### <a name="-keycloak_role_mapping--name"></a>`name`

namevar

--uusername/--gname

##### <a name="-keycloak_role_mapping--provider"></a>`provider`

The specific backend to use for this `keycloak_role_mapping` resource. You will seldom need to specify this --- Puppet
will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_role_mapping--realm"></a>`realm`

realm

### <a name="keycloak_sssd_user_provider"></a>`keycloak_sssd_user_provider`

Manage Keycloak SSSD user providers

#### Examples

##### Add SSSD user provider to test realm

```puppet
keycloak_sssd_user_provider { 'SSSD on test':
  ensure => 'present',
}
```

#### Properties

The following properties are available in the `keycloak_sssd_user_provider` type.

##### `cache_policy`

Valid values: `DEFAULT`, `EVICT_DAILY`, `EVICT_WEEKLY`, `MAX_LIFESPAN`, `NO_CACHE`

cachePolicy

Default value: `DEFAULT`

##### `enabled`

Valid values: `true`, `false`

enabled

Default value: `true`

##### `ensure`

Valid values: `present`, `absent`

The basic property that the resource should be in.

Default value: `present`

##### `eviction_day`

evictionDay

##### `eviction_hour`

evictionHour

##### `eviction_minute`

evictionMinute

##### `max_lifespan`

maxLifespan

##### `priority`

priority

Default value: `0`

#### Parameters

The following parameters are available in the `keycloak_sssd_user_provider` type.

* [`id`](#-keycloak_sssd_user_provider--id)
* [`name`](#-keycloak_sssd_user_provider--name)
* [`provider`](#-keycloak_sssd_user_provider--provider)
* [`realm`](#-keycloak_sssd_user_provider--realm)
* [`resource_name`](#-keycloak_sssd_user_provider--resource_name)

##### <a name="-keycloak_sssd_user_provider--id"></a>`id`

Id. Defaults to "`resource_name`-`realm`"

##### <a name="-keycloak_sssd_user_provider--name"></a>`name`

namevar

The SSSD user provider name

##### <a name="-keycloak_sssd_user_provider--provider"></a>`provider`

The specific backend to use for this `keycloak_sssd_user_provider` resource. You will seldom need to specify this ---
Puppet will usually discover the appropriate provider for your platform.

##### <a name="-keycloak_sssd_user_provider--realm"></a>`realm`

parentId

##### <a name="-keycloak_sssd_user_provider--resource_name"></a>`resource_name`

The SSSD user provider name. Defaults to `name`.

## Data types

### <a name="Keycloak--Configs"></a>`Keycloak::Configs`

https://www.keycloak.org/server/all-config

Alias of

```puppet
Struct[{
    Optional['cache'] => Enum['local', 'ispn'],
    Optional['cache-config-file'] => String[1],
    Optional['cache-embedded-mtls-enabled'] => Boolean,
    Optional['cache-embedded-mtls-key-store-file'] => String[1],
    Optional['cache-embedded-mtls-key-store-password'] => Variant[String[1], Sensitive],
    Optional['cache-embedded-mtls-trust-store-file'] => String[1],
    Optional['cache-embedded-mtls-trust-store-password'] => Variant[String[1], Sensitive],
    Optional['cache-remote-host'] => Variant[Stdlib::Host, Stdlib::IP::Address],
    Optional['cache-remote-password'] => Variant[String[1], Sensitive],
    Optional['cache-remote-port'] => Stdlib::Port,
    Optional['cache-remote-username'] => String[1],
    Optional['cache-stack'] => Enum['tcp','udp','kubernetes','ec2','azure','google'],
    Optional['db'] => Enum['dev-file','dev-mem','mariadb','mysql','oracle','postgres'],
    Optional['db-password'] => String[1],
    Optional['db-pool-initial-size'] => Integer,
    Optional['db-pool-max-size'] => Integer,
    Optional['db-pool-min-size'] => Integer,
    Optional['db-schema'] => String[1],
    Optional['db-url'] => String[1],
    Optional['db-url-database'] => String[1],
    Optional['db-url-host'] => Stdlib::Host,
    Optional['db-url-port'] => Stdlib::Port,
    Optional['db-url-properties'] => String[1],
    Optional['db-username'] => String[1],
    Optional['transaction-xa-enabled'] => Boolean,
    Optional['features'] => Array[String[1]],
    Optional['features-disabled'] => Array[String[1]],
    Optional['hostname'] => Variant[Stdlib::Host, Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['hostname-admin'] => Variant[Stdlib::HTTPUrl, Stdlib::HTTPSUrl],
    Optional['hostname-backchannel-dynamic'] => Boolean,
    Optional['hostname-debug'] => Boolean,
    Optional['hostname-strict'] => Boolean,
    Optional['http-enabled'] => Boolean,
    Optional['http-host'] => Stdlib::Host,
    Optional['http-max-queued-requests'] => Integer,
    Optional['http-pool-max-threads'] => Integer,
    Optional['http-port'] => Stdlib::Port,
    Optional['http-relative-path'] => String[1],
    Optional['https-certificate-file'] => Stdlib::Absolutepath,
    Optional['https-certificate-key-file'] => Stdlib::Absolutepath,
    Optional['https-cipher-suites'] => Array[String[1]],
    Optional['https-client-auth'] => Enum['none','request','required'],
    Optional['https-key-store-file'] => Stdlib::Absolutepath,
    Optional['https-key-store-password'] => Variant[String[1], Sensitive],
    Optional['https-key-store-type'] => String[1],
    Optional['https-port'] => Stdlib::Port,
    Optional['https-protocols'] => Array[String[1]],
    Optional['https-trust-store-file'] => Stdlib::Absolutepath,
    Optional['https-trust-store-password'] => Variant[String[1], Sensitive],
    Optional['https-trust-store-type'] => String[1],
    Optional['http-management-port'] => Stdlib::Port,
    Optional['http-management-relative-path'] => String[1],
    Optional['https-management-certificate-file'] => Stdlib::Absolutepath,
    Optional['https-management-certificate-key-file'] => Stdlib::Absolutepath,
    Optional['https-management-client-auth'] => Enum['none','request','required'],
    Optional['https-management-key-store-file'] => Stdlib::Absolutepath,
    Optional['https-management-key-store-password'] => Variant[String[1], Sensitive],
    Optional['health-enabled'] => Boolean,
    Optional['config-keystore'] => String[1],
    Optional['config-keystore-password'] => Variant[String[1], Sensitive],
    Optional['config-keystore-type'] => Enum['PKCS12'],
    Optional['metrics-enabled'] => Boolean,
    Optional['proxy'] => Enum['edge','reencrypt','passthrough','none'],
    Optional['proxy-headers'] => Enum['forwarded', 'xforwarded'],
    Optional['vault'] => Enum['file','keystore'],
    Optional['vault-dir'] => Stdlib::Absolutepath,
    Optional['vault-file'] => Stdlib::Absolutepath,
    Optional['vault-pass'] => Variant[String[1], Sensitive],
    Optional['vault-type'] => Enum['PKCS12'],
    Optional['log'] => Array[Enum['console','file','gelf','syslog']],
    Optional['log-console-color'] => Boolean,
    Optional['log-console-format'] => String[1],
    Optional['log-console-output'] => Enum['default','json'],
    Optional['log-file'] => String[1],
    Optional['log-file-format'] => String[1],
    Optional['log-file-output'] => Enum['default','json'],
    Optional['log-gelf-facility'] => String[1],
    Optional['log-gelf-host'] => Stdlib::Host,
    Optional['log-gelf-include-location'] => Boolean,
    Optional['log-gelf-include-message-parameters'] => Boolean,
    Optional['log-gelf-include-stack-trace'] => Boolean,
    Optional['log-gelf-level'] => String[1],
    Optional['log-gelf-max-message-size'] => Integer,
    Optional['log-gelf-port'] => Stdlib::Port,
    Optional['log-gelf-timestamp-format'] => String[1],
    Optional['log-syslog-protocol'] => Enum['tcp','udp','ssl-tcp'],
    Optional['log-syslog-endpoint'] => String[1],
    Optional['log-syslog-format'] => String[1],
    Optional['log-syslog-output'] => Enum['json','default'],
    Optional['log-level'] => String[1],
    Optional['tls-hostname-verifier'] => Enum['ANY','WILDCARD','STRICT'],
    Optional['truststore-paths'] => Array[String[1]],
    Optional['fips-mode'] => Enum['non-strict','strict'],
    Optional['dir'] => Stdlib::Absolutepath,
    Optional['realm'] => String[1],
    Optional['users'] => Enum['skip','realm_file','same_file','different_files'],
    Optional['users-per-file'] => Integer,
    Optional['file'] => Stdlib::Absolutepath,
    Optional['override'] => Boolean,
  }]
```