Chapter 23. All provider configuration

spi-authentication-sessions--infinispan--auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

int

300

spi-authentication-sessions--remote--auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

int

300

spi-authentication-sessions--remote--max-retries

The maximum number of retries if an error occurs.

int

10

spi-authentication-sessions--remote--retry-base-time

The base back-off time in milliseconds.

int

10

spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests

If concurrent logins are allowed by the brute force protection.

true, false

false

spi-cache-embedded--default--action-tokens-owners

Sets the number of owners for the actionTokens distributed cache.

Integer

spi-cache-embedded--default--authentication-sessions-owners

Sets the number of owners for the authenticationSessions distributed cache.

Integer

spi-cache-embedded--default--authorization-max-count

The maximum number of entries that can be stored in-memory by the authorization cache.

Integer

spi-cache-embedded--default--client-sessions-max-count

The maximum number of entries that can be stored in-memory by the clientSessions cache.

Integer

spi-cache-embedded--default--client-sessions-owners

Sets the number of owners for the clientSessions distributed cache.

Integer

spi-cache-embedded--default--config-file

Defines the file from which cache configuration should be loaded from.

String

spi-cache-embedded--default--crl-max-count

The maximum number of entries that can be stored in-memory by the crl cache.

Integer

spi-cache-embedded--default--fd-sock-enabled

Enables FD_SOCK2 failure detection.

true, false

true

spi-cache-embedded--default--keys-max-count

The maximum number of entries that can be stored in-memory by the keys cache.

Integer

spi-cache-embedded--default--login-failures-owners

Sets the number of owners for the loginFailures distributed cache.

Integer

spi-cache-embedded--default--machine-name

The name of the physical machine where this instance runs.

String

spi-cache-embedded--default--metrics-histograms-enabled

Enable histograms for metrics for the embedded caches.

true, false

false

spi-cache-embedded--default--network-bind-address

IP address used by clustering transport.

String

spi-cache-embedded--default--network-bind-port

The Port the clustering transport will bind to.

Integer

spi-cache-embedded--default--network-external-address

IP address that other instances in the cluster should use to contact this node.

String

spi-cache-embedded--default--network-external-port

Port that other instances in the cluster should use to contact this node.

Integer

spi-cache-embedded--default--node-name

Sets the name of the current node.

String

spi-cache-embedded--default--offline-client-sessions-max-count

The maximum number of entries that can be stored in-memory by the offlineClientSessions cache.

Integer

spi-cache-embedded--default--offline-sessions-max-count

The maximum number of entries that can be stored in-memory by the offlineSessions cache.

Integer

spi-cache-embedded--default--rack-name

The name of the rack where this instance runs.

String

spi-cache-embedded--default--realms-max-count

The maximum number of entries that can be stored in-memory by the realms cache.

Integer

spi-cache-embedded--default--sessions-max-count

The maximum number of entries that can be stored in-memory by the sessions cache.

Integer

spi-cache-embedded--default--sessions-owners

Sets the number of owners for the sessions distributed cache.

Integer

spi-cache-embedded--default--site-name

The name of the site (availability zone) where this instance runs.

String

spi-cache-embedded--default--users-max-count

The maximum number of entries that can be stored in-memory by the users cache.

Integer

spi-cache-remote--default--auth-realm

Specifies the Infinispan server realm to be used for authentication.

String

default

spi-cache-remote--default--backup-sites

Configures a list of backup sites names to where the external Infinispan cluster backups the Keycloak data.

List

spi-cache-remote--default--client-intelligence

Specifies the level of intelligence the Hot Rod client should have.

BASIC, TOPOLOGY_AWARE, HASH_DISTRIBUTION_AWARE

HASH_DISTRIBUTION_AWARE

spi-cache-remote--default--connection-pool-exhausted-action

Specifies what happens when asking for a connection from a server’s pool, and that pool is exhausted.

EXCEPTION, WAIT, CREATE_NEW

CREATE_NEW

spi-cache-remote--default--connection-pool-max-active

Sets the maximum number of connections per Infinispan server instance.

Integer

16

spi-cache-remote--default--hostname

The hostname of the external Infinispan cluster.

String

spi-cache-remote--default--password

The password for the authentication to the external Infinispan cluster.

String

spi-cache-remote--default--port

The port of the external Infinispan cluster.

Integer

11222

spi-cache-remote--default--properties-file

Path to the properties file with the Hot Rod client configuration.

File

spi-cache-remote--default--sasl-mechanism

Selects the SASL mechanism to use for the connection to the Infinispan server.

String

SCRAM-SHA-512

spi-cache-remote--default--tls-enabled

Enable TLS support to communicate with a secured remote Infinispan server.

true, false

true

spi-cache-remote--default--tls-sni-hostname

Specifies the TLS SNI hostname for the connection to the Infinispan server.

String

spi-cache-remote--default--username

The username for the authentication to the external Infinispan cluster.

String

spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri

The HTTP(S) URI of the authentication channel.

string

spi-client-policy-executor--client-id-metadata-document--cimd-provider-name

Provider to use for the CIMD

string

persistent-cimd

spi-client-policy-executor--client-id-metadata-document--max-cache-time

Max cache time of client metadata in seconds for the CIMD.

int

259200

spi-client-policy-executor--client-id-metadata-document--min-cache-time

Min cache time of client metadata in seconds for the CIMD.

int

300

spi-client-policy-executor--client-id-metadata-document--upper-limit-metadata-bytes

Client metadata upper limit in byte for the CIMD.

int

5000

spi-connections-http-client--default--allow-redirects

Whether to allow following HTTP redirects.

true, false

false

spi-connections-http-client--default--backoff-multiplier

Multiplier for exponential backoff between retry attempts.

string

2.0

spi-connections-http-client--default--client-key-password

The key password.

string

-1

spi-connections-http-client--default--client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

string

spi-connections-http-client--default--client-keystore-password

The key store password.

string

spi-connections-http-client--default--connection-pool-size

Assigns maximum total connection value.

int

spi-connections-http-client--default--connection-request-timeout-millis

Timeout when trying to obtain any connection, new or pooled.

long

5000

spi-connections-http-client--default--connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

long

-1

spi-connections-http-client--default--disable-cookies

Disables state (cookie) management.

true, false

true

spi-connections-http-client--default--disable-trust-manager

Disable trust management and hostname verification.

true, false

false

spi-connections-http-client--default--establish-connection-timeout-millis

Timeout when making an initial socket connection.

long

-1

spi-connections-http-client--default--initial-backoff-millis

Initial backoff time in milliseconds before the first retry attempt.

long

1000

spi-connections-http-client--default--jitter-factor

Jitter factor to apply to backoff times.

string

0.5

spi-connections-http-client--default--max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

long

900000

spi-connections-http-client--default--max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

long

10000000

spi-connections-http-client--default--max-pooled-per-route

Assigns maximum connection per route value.

int

64

spi-connections-http-client--default--max-retries

Maximum number of retry attempts for all outgoing HTTP requests.

int

0

spi-connections-http-client--default--proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

string

spi-connections-http-client--default--reuse-connections

If connections should be reused.

true, false

true

spi-connections-http-client--default--socket-timeout-millis

Socket inactivity timeout.

long

5000

spi-connections-http-client--default--use-jitter

Whether to apply jitter to backoff times to prevent synchronized retry storms when multiple clients are retrying at the same time.

true, false

true

spi-connections-http-client--opentelemetry--allow-redirects

Whether to allow following HTTP redirects.

true, false

false

spi-connections-http-client--opentelemetry--backoff-multiplier

Multiplier for exponential backoff between retry attempts.

string

2.0

spi-connections-http-client--opentelemetry--client-key-password

The key password.

string

-1

spi-connections-http-client--opentelemetry--client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

string

spi-connections-http-client--opentelemetry--client-keystore-password

The key store password.

string

spi-connections-http-client--opentelemetry--connection-pool-size

Assigns maximum total connection value.

int

spi-connections-http-client--opentelemetry--connection-request-timeout-millis

Timeout when trying to obtain any connection, new or pooled.

long

5000

spi-connections-http-client--opentelemetry--connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

long

-1

spi-connections-http-client--opentelemetry--disable-cookies

Disables state (cookie) management.

true, false

true

spi-connections-http-client--opentelemetry--disable-trust-manager

Disable trust management and hostname verification.

true, false

false

spi-connections-http-client--opentelemetry--establish-connection-timeout-millis

Timeout when making an initial socket connection.

long

-1

spi-connections-http-client--opentelemetry--initial-backoff-millis

Initial backoff time in milliseconds before the first retry attempt.

long

1000

spi-connections-http-client--opentelemetry--jitter-factor

Jitter factor to apply to backoff times.

string

0.5

spi-connections-http-client--opentelemetry--max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

long

900000

spi-connections-http-client--opentelemetry--max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

long

10000000

spi-connections-http-client--opentelemetry--max-pooled-per-route

Assigns maximum connection per route value.

int

64

spi-connections-http-client--opentelemetry--max-retries

Maximum number of retry attempts for all outgoing HTTP requests.

int

0

spi-connections-http-client--opentelemetry--proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

string

spi-connections-http-client--opentelemetry--reuse-connections

If connections should be reused.

true, false

true

spi-connections-http-client--opentelemetry--socket-timeout-millis

Socket inactivity timeout.

long

5000

spi-connections-http-client--opentelemetry--use-jitter

Whether to apply jitter to backoff times to prevent synchronized retry storms when multiple clients are retrying at the same time.

true, false

true

spi-connections-jpa--quarkus--initialize-empty

Initialize database if empty.

true, false

true

spi-connections-jpa--quarkus--migration-export

Path for where to write manual database initialization/migration file.

string

spi-connections-jpa--quarkus--migration-strategy

Strategy to use to migrate database.

update, manual, validate

update

spi-cors--default--allowed-headers

A comma-separated list of additional allowed headers for CORS requests

string

spi-credential--keycloak-password--validations-counter-tags

Comma-separated list of tags to be used when publishing password validation counter metric.

realm, algorithm, hashing_strength, outcome

realm,algorithm,hashing_strength,outcome

spi-crl-storage--infinispan--cache-time

Interval in seconds that the CRL is cached.

int

-1

spi-crl-storage--infinispan--min-time-between-requests

Minimum interval in seconds between two requests to retrieve the CRL.

int

10

spi-datastore--legacy--allow-migrate-existing-database-to-snapshot

By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.

true, false

false

spi-device-representation--device-representation--cache-size

Sets the maximum number of parsed user-agent values in the local cache.

Integer

2048

spi-events-listener--email--exclude-events

A comma-separated list of events that should not be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, jwt_authorization_grant, jwt_authorization_grant_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, user_session_deleted, user_session_deleted_error, validate_access_token, validate_access_token_error, verifiable_credential_create_offer, verifiable_credential_create_offer_error, verifiable_credential_nonce_request, verifiable_credential_nonce_request_error, verifiable_credential_offer_request, verifiable_credential_offer_request_error, verifiable_credential_pre_authorized_grant, verifiable_credential_pre_authorized_grant_error, verifiable_credential_request, verifiable_credential_request_error, verify_email, verify_email_error, verify_profile, verify_profile_error

spi-events-listener--email--include-events

A comma-separated list of events that should be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, jwt_authorization_grant, jwt_authorization_grant_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, user_session_deleted, user_session_deleted_error, validate_access_token, validate_access_token_error, verifiable_credential_create_offer, verifiable_credential_create_offer_error, verifiable_credential_nonce_request, verifiable_credential_nonce_request_error, verifiable_credential_offer_request, verifiable_credential_offer_request_error, verifiable_credential_pre_authorized_grant, verifiable_credential_pre_authorized_grant_error, verifiable_credential_request, verifiable_credential_request_error, verify_email, verify_email_error, verify_profile, verify_profile_error

All events

spi-events-listener--jboss-logging--error-level

The log level for error messages.

debug, error, fatal, info, trace, warn

warn

spi-events-listener--jboss-logging--include-representation

When "true" the "representation" field with the JSON admin object is also added to the message.

true, false

false

spi-events-listener--jboss-logging--quotes

The quotes to use for values, it should be one character like " or '.

string

"

spi-events-listener--jboss-logging--sanitize

If true the log messages are sanitized to avoid line breaks.

true, false

true

spi-events-listener--jboss-logging--success-level

The log level for success messages.

debug, error, fatal, info, trace, warn

debug

spi-events-listener--micrometer-user-event-metrics--max-client-id-tags

Maximum number of distinct client ID tag values before new values are denied to prevent metrics cardinality explosion.

Integer

10000

spi-events-listener--micrometer-user-event-metrics--max-error-tags

Maximum number of distinct error tag values before new values are denied to prevent metrics cardinality explosion.

Integer

10000

spi-export--dir--dir

Directory to export to

string

spi-export--dir--realm-name

Realm to export

string

spi-export--dir--users-export-strategy

Users export strategy

string

DIFFERENT_FILES

spi-export--dir--users-per-file

Users per exported file

int

50

spi-export--single-file--file

File to export to

string

spi-export--single-file--realm-name

Realm to export

string

spi-group--jpa--escape-slashes-in-group-path

If true slashes / in group names are escaped with the character ~ when converted to paths.

true, false

false

spi-group--jpa--searchable-attributes

The list of attributes separated by comma that are allowed in client attribute searches.

string

spi-import--dir--dir

Directory to import from

string

spi-import--dir--realm-name

Realm to export

string

spi-import--dir--strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

string

spi-import--single-file--file

File to import from

string

spi-import--single-file--realm-name

Realm to export

string

spi-import--single-file--strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

string

spi-jgroups-mtls--default--enabled

Encrypts the network communication between Keycloak servers.

true, false

true

spi-jgroups-mtls--default--keystore-file

The Keystore file path.

String

spi-jgroups-mtls--default--keystore-password

The password to access the Keystore.

Password

spi-jgroups-mtls--default--rotation

Rotation period in days of automatic JGroups MTLS certificates.

Integer

30

spi-jgroups-mtls--default--truststore-file

The Truststore file path.

String

spi-jgroups-mtls--default--truststore-password

The password to access the Truststore.

Password

spi-keys--java-keystore--keystores-path

The parent directory where the keystore files should be placed.

string

spi-load-balancer-check--remote--poll-interval

The Remote caches poll interval, in milliseconds, for connection availability

int

5000

spi-login-protocol--openid-connect--add-req-params-fail-fast

Whether the fail-fast strategy should be enforced in case if the limit for some standard OIDC parameter or additional OIDC parameter is not met for the parameters sent to the OIDC authentication or token endpoints.

true, false

false

spi-login-protocol--openid-connect--add-req-params-max-number

Maximum number of additional request parameters sent to the OIDC authentication or token endpoints.

int

5

spi-login-protocol--openid-connect--add-req-params-max-overall-size

Maximum size of all additional request parameters values together.

int

2147483647

spi-login-protocol--openid-connect--add-req-params-max-size

Maximum size of single additional request parameter value See add-req-params-max-number for more details about additional request parameters

int

2000

spi-login-protocol--openid-connect--add-req-token-params-fail-fast

Whether the fail-fast strategy should be enforced in case if the limit for some token parameter is not met for the parameters sent to the OIDC token endpoint.

true, false

true

spi-login-protocol--openid-connect--allow-client-initiated-account-linking

Allows the deprecated client-initiated account linking endpoint (/broker/{provider}/link).

true, false

false

spi-login-protocol--openid-connect--allow-oidc-params-in-redirect-uris

Allows OIDC parameters (state, code, etc.

true, false

false

spi-login-protocol--openid-connect--allow-token-introspection-without-audience-check

Allows token introspection without audience validation for any client.

true, false

false

spi-login-protocol--openid-connect--allow-userinfo-with-lightweight-access-token

Allows lightweight access tokens to be used with the UserInfo endpoint.

true, false

false

spi-login-protocol--openid-connect--req-params-default-max-size

Maximum default length of the standard OIDC parameter sent to the OIDC authentication or token endpoints.

int

4000

spi-login-protocol--openid-connect--req-params-max-size--login_hint

Maximum length of the standard parameter sent to OIDC authentication or token endpoints overriden for the specified parameter.

int

spi-login-protocol--openid-connect--req-token-params-default-max-size

Maximum default length of the token parameter sent to the OIDC token endpoint.

int

20000

spi-login-protocol--saml--max-inflating-size

The maximum inflating size in bytes for the REDIRECT binding.

long

131072

spi-login-failure--remote--max-retries

The maximum number of retries if an error occurs.

int

10

spi-login-failure--remote--retry-base-time

The base back-off time in milliseconds.

int

10

spi-mapped-diagnostic-context--default--mdc-keys

Comma-separated list of MDC keys to add to the Mapped Diagnostic Context.

realmName, clientId, userId, ipAddress, org, sessionId, authenticationSessionId, authenticationTabId

spi-password-hashing--argon2--cpu-cores

Maximum parallel CPU cores to use for hashing

int

spi-password-hashing--argon2--hash-length

Hash length

int

32

spi-password-hashing--argon2--iterations

Iterations

int

5

spi-password-hashing--argon2--memory

Memory size (KB)

int

7168

spi-password-hashing--argon2--parallelism

Parallelism

int

1

spi-password-hashing--argon2--type

Type

id, d, i

id

spi-password-hashing--argon2--version

Version

1.3, 1.0

1.3

spi-password-policy--password-blacklist--check-interval-seconds

Interval in number of seconds when the server should check the password file for changes and reload it.

string

60

spi-password-policy--password-blacklist--false-positive-probability

False positive probability of the bloom filter to reject a valid password.

string

0.0001

spi-public-key-storage--infinispan--max-cache-time

Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.

int

86400

spi-public-key-storage--infinispan--min-time-between-requests

Minimum interval in seconds between two requests to retrieve the new public keys.

int

10

spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold

When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will recommend him to setup new set of recovery codes.

Integer

4

spi-required-action--CONFIGURE_TOTP--add-recovery-codes

If this option is enabled, the user will be required to configure recovery codes following the OTP configuration.

true, false

false

spi-required-action--CONFIGURE_TOTP--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--TERMS_AND_CONDITIONS--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--UPDATE_EMAIL--email-resend-cooldown-seconds

Minimum delay in seconds before another email verification email can be sent.

String

30

spi-required-action--UPDATE_EMAIL--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--UPDATE_EMAIL--verify-email

If enabled, the user will be forced to verify the email regardless if email verification is enabled at the realm level or not.

true, false

false

spi-required-action--UPDATE_PASSWORD--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--UPDATE_PROFILE--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--VERIFY_EMAIL--email-resend-cooldown-seconds

Minimum delay in seconds before another email verification email can be sent.

String

30

spi-required-action--VERIFY_EMAIL--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--VERIFY_PROFILE--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--delete_credential--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--idp_link--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--update_user_locale--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--verifiable_credential_offer--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--webauthn-register--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-required-action--webauthn-register-passwordless--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

String

300

spi-resource-encoding--gzip--excluded-content-types

A space separated list of content-types to exclude from encoding.

string

image/png image/jpeg

spi-security-profile--default--name

Name for the security configuration file to use.

string

spi-single-use-object--infinispan--persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true, false

true

spi-single-use-object--remote--persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true, false

true

spi-sticky-session-encoder--infinispan--should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true, false

true

spi-sticky-session-encoder--remote--should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true, false

true

spi-storage--ldap--secure-referral

Allow only secure LDAP referrals (deprecated)

true, false

true

spi-truststore--file--file

DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.

string

spi-truststore--file--hostname-verification-policy

DEPRECATED: The hostname verification policy.

ANY, WILDCARD, STRICT, DEFAULT

DEFAULT

spi-truststore--file--password

DEPRECATED: The trust store password.

string

spi-truststore--file--type

DEPRECATED: Type of the truststore.

string

spi-user-profile--declarative-user-profile--admin-read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so administrators can’t change them.

MultivaluedString

spi-user-profile--declarative-user-profile--max-email-local-part-length

To set user profile max email local part length

String

spi-user-profile--declarative-user-profile--read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so users can’t change them.

MultivaluedString

spi-user-session-persister--jpa--expiration-batch

Sets the size of the expiration batch, i.

Integer

512

spi-user-sessions--infinispan--max-batch-size

Maximum size of a batch (only applicable to persistent sessions

int

4

spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override

Override how long offline client sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)

int

spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override

Override how long offline user sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)

int

spi-user-sessions--infinispan--session-expiration-period

Sets the expiration task run period, to remove the expired session.

int

spi-user-sessions--infinispan--use-batches

Enable or disable batch writes to the database.

true, false

false

spi-user-sessions--infinispan--use-caches

Enable or disable caches.

true, false

spi-user-sessions--remote--batch-size

Batch size when streaming session from the remote cache

int

1024

spi-user-sessions--remote--max-retries

The maximum number of retries if an error occurs.

int

10

spi-user-sessions--remote--retry-base-time

The base back-off time in milliseconds.

int

10

spi-well-known--oauth-authorization-server--include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true, false

true

spi-well-known--oauth-authorization-server--openid-configuration-override

The file path from where the metadata should be loaded from.

string

spi-well-known--openid-configuration--include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true, false

true

spi-well-known--openid-configuration--openid-configuration-override

The file path from where the metadata should be loaded from.

string

spi-workflow--default--executor-task-timeout

The time in milliseconds before a workflow task is marked as timed out .

long

5000