
:guide-id: all-provider-config
:guide-parent: 
:guide-title: All provider configuration
:guide-summary: Review provider configuration options.
:guide-priority: 999
:guide-tile-visible: true
:version: 26.4.0

include::../attributes.adoc[]

[[all-provider-config]]
= All provider configuration

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


== authentication-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-authentication-sessions--infinispan--auth-sessions-limit+`# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended--spi-authentication-sessions--infinispan--auth-sessions-limit,role="options-extended"]
--




*CLI:* `+--spi-authentication-sessions--infinispan--auth-sessions-limit+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__INFINISPAN__AUTH_SESSIONS_LIMIT+`
--



|[.options-default]#`+300+`# (default) or any `+int+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-authentication-sessions--remote--auth-sessions-limit+`# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended--spi-authentication-sessions--remote--auth-sessions-limit,role="options-extended"]
--




*CLI:* `+--spi-authentication-sessions--remote--auth-sessions-limit+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__AUTH_SESSIONS_LIMIT+`
--



|[.options-default]#`+300+`# (default) or any `+int+`

|
[.options-key]#`+spi-authentication-sessions--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-authentication-sessions--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#



*CLI:* `+--spi-authentication-sessions--remote--max-retries+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-authentication-sessions--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-authentication-sessions--remote--retry-base-time,role="options-extended"]
--




*CLI:* `+--spi-authentication-sessions--remote--retry-base-time+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== brute-force-protector
=== default-brute-force-detector
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests+`# 

[.options-description]#If concurrent logins are allowed by the brute force protection.#

[#option-extended--spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests,role="options-extended"]
--




*CLI:* `+--spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests+` +
*Env:* `+KC_SPI_BRUTE_FORCE_PROTECTOR__DEFAULT_BRUTE_FORCE_DETECTOR__ALLOW_CONCURRENT_REQUESTS+`
--



|
`+true+`, `+false+` (default)


|===
== cache-embedded
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-cache-embedded--default--action-tokens-owners+`# 

[.options-description]#Sets the number of owners for the actionTokens distributed cache.#

[#option-extended--spi-cache-embedded--default--action-tokens-owners,role="options-extended"]
--
[.options-description-extended]#It defines the number of copies of your data in the cluster.#



*CLI:* `+--spi-cache-embedded--default--action-tokens-owners+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__ACTION_TOKENS_OWNERS+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--authentication-sessions-owners+`# 

[.options-description]#Sets the number of owners for the authenticationSessions distributed cache.#

[#option-extended--spi-cache-embedded--default--authentication-sessions-owners,role="options-extended"]
--
[.options-description-extended]#It defines the number of copies of your data in the cluster.#



*CLI:* `+--spi-cache-embedded--default--authentication-sessions-owners+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__AUTHENTICATION_SESSIONS_OWNERS+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--authorization-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the authorization cache.#

[#option-extended--spi-cache-embedded--default--authorization-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--authorization-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__AUTHORIZATION_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--authorization-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the authorizationRevisions cache.#

[#option-extended--spi-cache-embedded--default--authorization-revisions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--authorization-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__AUTHORIZATION_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the clientSessions cache.#

[#option-extended--spi-cache-embedded--default--client-sessions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--client-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CLIENT_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--client-sessions-owners+`# 

[.options-description]#Sets the number of owners for the clientSessions distributed cache.#

[#option-extended--spi-cache-embedded--default--client-sessions-owners,role="options-extended"]
--
[.options-description-extended]#It defines the number of copies of your data in the cluster.#



*CLI:* `+--spi-cache-embedded--default--client-sessions-owners+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CLIENT_SESSIONS_OWNERS+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--config-file+`# 

[.options-description]#Defines the file from which cache configuration should be loaded from.#

[#option-extended--spi-cache-embedded--default--config-file,role="options-extended"]
--
[.options-description-extended]#The configuration file is relative to the `conf/` directory.#



*CLI:* `+--spi-cache-embedded--default--config-file+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CONFIG_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--crl-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the crl cache.#

[#option-extended--spi-cache-embedded--default--crl-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--crl-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CRL_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--keys-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the keys cache.#

[#option-extended--spi-cache-embedded--default--keys-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--keys-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__KEYS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--login-failures-owners+`# 

[.options-description]#Sets the number of owners for the loginFailures distributed cache.#

[#option-extended--spi-cache-embedded--default--login-failures-owners,role="options-extended"]
--
[.options-description-extended]#It defines the number of copies of your data in the cluster.#



*CLI:* `+--spi-cache-embedded--default--login-failures-owners+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__LOGIN_FAILURES_OWNERS+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--machine-name+`# 

[.options-description]#The name of the physical machine where this instance runs.#

[#option-extended--spi-cache-embedded--default--machine-name,role="options-extended"]
--
[.options-description-extended]#It can be set if multiple Keycloak instances are running in the same physical machines. Infinispan takes into consideration this value to keep the backup data spread between different machines.#



*CLI:* `+--spi-cache-embedded--default--machine-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__MACHINE_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--metrics-histograms-enabled+`# 

[.options-description]#Enable histograms for metrics for the embedded caches.#

[#option-extended--spi-cache-embedded--default--metrics-histograms-enabled,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--metrics-histograms-enabled+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__METRICS_HISTOGRAMS_ENABLED+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-cache-embedded--default--network-bind-address+`# 

[.options-description]#IP address used by clustering transport.#

[#option-extended--spi-cache-embedded--default--network-bind-address,role="options-extended"]
--
[.options-description-extended]#By default, SITE_LOCAL is used.#



*CLI:* `+--spi-cache-embedded--default--network-bind-address+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NETWORK_BIND_ADDRESS+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--network-bind-port+`# 

[.options-description]#The Port the clustering transport will bind to.#

[#option-extended--spi-cache-embedded--default--network-bind-port,role="options-extended"]
--
[.options-description-extended]#By default, port 7800 is used.#



*CLI:* `+--spi-cache-embedded--default--network-bind-port+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NETWORK_BIND_PORT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--network-external-address+`# 

[.options-description]#IP address that other instances in the cluster should use to contact this node.#

[#option-extended--spi-cache-embedded--default--network-external-address,role="options-extended"]
--
[.options-description-extended]#Set only if it is different to cache-embedded-network-bind-address, for example when this instance is behind a firewall.#



*CLI:* `+--spi-cache-embedded--default--network-external-address+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NETWORK_EXTERNAL_ADDRESS+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--network-external-port+`# 

[.options-description]#Port that other instances in the cluster should use to contact this node.#

[#option-extended--spi-cache-embedded--default--network-external-port,role="options-extended"]
--
[.options-description-extended]#Set only if it is different to cache-embedded-network-bind-port, for example when this instance is behind a firewall#



*CLI:* `+--spi-cache-embedded--default--network-external-port+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NETWORK_EXTERNAL_PORT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--node-name+`# 

[.options-description]#Sets the name of the current node.#

[#option-extended--spi-cache-embedded--default--node-name,role="options-extended"]
--
[.options-description-extended]#This is a friendly name to make logs, etc. make more sense.#



*CLI:* `+--spi-cache-embedded--default--node-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NODE_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--offline-client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineClientSessions cache.#

[#option-extended--spi-cache-embedded--default--offline-client-sessions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--offline-client-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__OFFLINE_CLIENT_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--offline-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineSessions cache.#

[#option-extended--spi-cache-embedded--default--offline-sessions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--offline-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__OFFLINE_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--rack-name+`# 

[.options-description]#The name of the rack where this instance runs.#

[#option-extended--spi-cache-embedded--default--rack-name,role="options-extended"]
--
[.options-description-extended]#It can be set if multiple Keycloak instances are running in the same physical rack. Infinispan takes into consideration this value to keep the backup data spread between different racks.#



*CLI:* `+--spi-cache-embedded--default--rack-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__RACK_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--realm-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the realmRevisions cache.#

[#option-extended--spi-cache-embedded--default--realm-revisions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--realm-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__REALM_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--realms-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the realms cache.#

[#option-extended--spi-cache-embedded--default--realms-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--realms-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__REALMS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the sessions cache.#

[#option-extended--spi-cache-embedded--default--sessions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--sessions-owners+`# 

[.options-description]#Sets the number of owners for the sessions distributed cache.#

[#option-extended--spi-cache-embedded--default--sessions-owners,role="options-extended"]
--
[.options-description-extended]#It defines the number of copies of your data in the cluster.#



*CLI:* `+--spi-cache-embedded--default--sessions-owners+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__SESSIONS_OWNERS+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--site-name+`# 

[.options-description]#The name of the site (availability zone) where this instance runs.#

[#option-extended--spi-cache-embedded--default--site-name,role="options-extended"]
--
[.options-description-extended]#It can be set if running Keycloak in different availability zones. Infinispan takes into consideration this value to keep the backup data spread between different sites.#



*CLI:* `+--spi-cache-embedded--default--site-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__SITE_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--user-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the userRevisions cache.#

[#option-extended--spi-cache-embedded--default--user-revisions-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--user-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__USER_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--users-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the users cache.#

[#option-extended--spi-cache-embedded--default--users-max-count,role="options-extended"]
--




*CLI:* `+--spi-cache-embedded--default--users-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__USERS_MAX_COUNT+`
--



|any `+Integer+`


|===
== cache-remote
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-cache-remote--default--auth-realm+`# 

[.options-description]#Specifies the Infinispan server realm to be used for authentication.#

[#option-extended--spi-cache-remote--default--auth-realm,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--auth-realm+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__AUTH_REALM+`
--



|[.options-default]#`+default+`# (default) or any `+String+`

|
[.options-key]#`+spi-cache-remote--default--backup-sites+`# 

[.options-description]#Configures a list of backup sites names to where the external Infinispan cluster backups the Keycloak data.#

[#option-extended--spi-cache-remote--default--backup-sites,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--backup-sites+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__BACKUP_SITES+`
--



|any `+List+`

|
[.options-key]#`+spi-cache-remote--default--client-intelligence+`# 

[.options-description]#Specifies the level of intelligence the Hot Rod client should have.#

[#option-extended--spi-cache-remote--default--client-intelligence,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--client-intelligence+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CLIENT_INTELLIGENCE+`
--



|
`+BASIC+`, `+TOPOLOGY_AWARE+`, `+HASH_DISTRIBUTION_AWARE+` (default)

|
[.options-key]#`+spi-cache-remote--default--connection-pool-exhausted-action+`# 

[.options-description]#Specifies what happens when asking for a connection from a server's pool, and that pool is exhausted.#

[#option-extended--spi-cache-remote--default--connection-pool-exhausted-action,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--connection-pool-exhausted-action+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CONNECTION_POOL_EXHAUSTED_ACTION+`
--



|
`+EXCEPTION+`, `+WAIT+`, `+CREATE_NEW+` (default)

|
[.options-key]#`+spi-cache-remote--default--connection-pool-max-active+`# 

[.options-description]#Sets the maximum number of connections per Infinispan server instance.#

[#option-extended--spi-cache-remote--default--connection-pool-max-active,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--connection-pool-max-active+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CONNECTION_POOL_MAX_ACTIVE+`
--



|[.options-default]#`+16+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-cache-remote--default--hostname+`# 

[.options-description]#The hostname of the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--hostname,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--hostname+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__HOSTNAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--password+`# 

[.options-description]#The password for the authentication to the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--password,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-username` is required as well.#



*CLI:* `+--spi-cache-remote--default--password+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PASSWORD+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--port+`# 

[.options-description]#The port of the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--port,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--port+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PORT+`
--



|[.options-default]#`+11222+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-cache-remote--default--properties-file+`# 

[.options-description]#Path to the properties file with the Hot Rod client configuration.#

[#option-extended--spi-cache-remote--default--properties-file,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--properties-file+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PROPERTIES_FILE+`
--



|any `+File+`

|
[.options-key]#`+spi-cache-remote--default--sasl-mechanism+`# 

[.options-description]#Selects the SASL mechanism to use for the connection to the Infinispan server.#

[#option-extended--spi-cache-remote--default--sasl-mechanism,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--sasl-mechanism+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__SASL_MECHANISM+`
--



|[.options-default]#`+SCRAM-SHA-512+`# (default) or any `+String+`

|
[.options-key]#`+spi-cache-remote--default--tls-enabled+`# 

[.options-description]#Enable TLS support to communicate with a secured remote Infinispan server.#

[#option-extended--spi-cache-remote--default--tls-enabled,role="options-extended"]
--
[.options-description-extended]#Recommended to be enabled in production.#



*CLI:* `+--spi-cache-remote--default--tls-enabled+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__TLS_ENABLED+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-cache-remote--default--tls-sni-hostname+`# 

[.options-description]#Specifies the TLS SNI hostname for the connection to the Infinispan server.#

[#option-extended--spi-cache-remote--default--tls-sni-hostname,role="options-extended"]
--




*CLI:* `+--spi-cache-remote--default--tls-sni-hostname+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__TLS_SNI_HOSTNAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--username+`# 

[.options-description]#The username for the authentication to the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--username,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-password` is required as well.#



*CLI:* `+--spi-cache-remote--default--username+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__USERNAME+`
--



|any `+String+`


|===
== ciba-auth-channel
=== ciba-http-auth-channel
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri+`# 

[.options-description]#The HTTP(S) URI of the authentication channel.#

[#option-extended--spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri,role="options-extended"]
--




*CLI:* `+--spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri+` +
*Env:* `+KC_SPI_CIBA_AUTH_CHANNEL__CIBA_HTTP_AUTH_CHANNEL__HTTP_AUTHENTICATION_CHANNEL_URI+`
--



|any `+string+`


|===
== connections-http-client
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-http-client--default--client-key-password+`# 

[.options-description]#The key password.#

[#option-extended--spi-connections-http-client--default--client-key-password,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--client-key-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEY_PASSWORD+`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--client-keystore+`# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended--spi-connections-http-client--default--client-keystore,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--client-keystore+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEYSTORE+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--client-keystore-password+`# 

[.options-description]#The key store password.#

[#option-extended--spi-connections-http-client--default--client-keystore-password,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--client-keystore-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEYSTORE_PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--connection-pool-size+`# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended--spi-connections-http-client--default--connection-pool-size,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--connection-pool-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CONNECTION_POOL_SIZE+`
--



|any `+int+`

|
[.options-key]#`+spi-connections-http-client--default--connection-ttl-millis+`# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended--spi-connections-http-client--default--connection-ttl-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--connection-ttl-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CONNECTION_TTL_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--disable-cookies+`# 

[.options-description]#Disables state (cookie) management.#

[#option-extended--spi-connections-http-client--default--disable-cookies,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--disable-cookies+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__DISABLE_COOKIES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--default--disable-trust-manager+`# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended--spi-connections-http-client--default--disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#



*CLI:* `+--spi-connections-http-client--default--disable-trust-manager+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__DISABLE_TRUST_MANAGER+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-connections-http-client--default--establish-connection-timeout-millis+`# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended--spi-connections-http-client--default--establish-connection-timeout-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--establish-connection-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__ESTABLISH_CONNECTION_TIMEOUT_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-connection-idle-time-millis+`# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended--spi-connections-http-client--default--max-connection-idle-time-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--max-connection-idle-time-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_CONNECTION_IDLE_TIME_MILLIS+`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-consumed-response-size+`# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended--spi-connections-http-client--default--max-consumed-response-size,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--max-consumed-response-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_CONSUMED_RESPONSE_SIZE+`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-pooled-per-route+`# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended--spi-connections-http-client--default--max-pooled-per-route,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--max-pooled-per-route+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_POOLED_PER_ROUTE+`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#`+spi-connections-http-client--default--proxy-mappings+`# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended--spi-connections-http-client--default--proxy-mappings,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--proxy-mappings+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__PROXY_MAPPINGS+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--reuse-connections+`# 

[.options-description]#If connections should be reused.#

[#option-extended--spi-connections-http-client--default--reuse-connections,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--reuse-connections+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__REUSE_CONNECTIONS+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--default--socket-timeout-millis+`# 

[.options-description]#Socket inactivity timeout.#

[#option-extended--spi-connections-http-client--default--socket-timeout-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--default--socket-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__SOCKET_TIMEOUT_MILLIS+`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
=== opentelemetry
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-key-password+`# 

[.options-description]#The key password.#

[#option-extended--spi-connections-http-client--opentelemetry--client-key-password,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--client-key-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEY_PASSWORD+`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-keystore+`# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended--spi-connections-http-client--opentelemetry--client-keystore,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--client-keystore+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEYSTORE+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-keystore-password+`# 

[.options-description]#The key store password.#

[#option-extended--spi-connections-http-client--opentelemetry--client-keystore-password,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--client-keystore-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEYSTORE_PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--connection-pool-size+`# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended--spi-connections-http-client--opentelemetry--connection-pool-size,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--connection-pool-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CONNECTION_POOL_SIZE+`
--



|any `+int+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--connection-ttl-millis+`# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended--spi-connections-http-client--opentelemetry--connection-ttl-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--connection-ttl-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CONNECTION_TTL_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--disable-cookies+`# 

[.options-description]#Disables state (cookie) management.#

[#option-extended--spi-connections-http-client--opentelemetry--disable-cookies,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--disable-cookies+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__DISABLE_COOKIES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--disable-trust-manager+`# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended--spi-connections-http-client--opentelemetry--disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#



*CLI:* `+--spi-connections-http-client--opentelemetry--disable-trust-manager+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__DISABLE_TRUST_MANAGER+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-connections-http-client--opentelemetry--establish-connection-timeout-millis+`# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended--spi-connections-http-client--opentelemetry--establish-connection-timeout-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--establish-connection-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__ESTABLISH_CONNECTION_TIMEOUT_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-connection-idle-time-millis+`# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended--spi-connections-http-client--opentelemetry--max-connection-idle-time-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--max-connection-idle-time-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_CONNECTION_IDLE_TIME_MILLIS+`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-consumed-response-size+`# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended--spi-connections-http-client--opentelemetry--max-consumed-response-size,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--max-consumed-response-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_CONSUMED_RESPONSE_SIZE+`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-pooled-per-route+`# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended--spi-connections-http-client--opentelemetry--max-pooled-per-route,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--max-pooled-per-route+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_POOLED_PER_ROUTE+`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--proxy-mappings+`# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended--spi-connections-http-client--opentelemetry--proxy-mappings,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--proxy-mappings+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__PROXY_MAPPINGS+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--reuse-connections+`# 

[.options-description]#If connections should be reused.#

[#option-extended--spi-connections-http-client--opentelemetry--reuse-connections,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--reuse-connections+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__REUSE_CONNECTIONS+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--socket-timeout-millis+`# 

[.options-description]#Socket inactivity timeout.#

[#option-extended--spi-connections-http-client--opentelemetry--socket-timeout-millis,role="options-extended"]
--




*CLI:* `+--spi-connections-http-client--opentelemetry--socket-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__SOCKET_TIMEOUT_MILLIS+`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
== connections-jpa
=== quarkus
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-jpa--quarkus--initialize-empty+`# 

[.options-description]#Initialize database if empty.#

[#option-extended--spi-connections-jpa--quarkus--initialize-empty,role="options-extended"]
--
[.options-description-extended]#If set to false the database has to be manually initialized. If you want to manually initialize the database set migrationStrategy to manual which will create a file with SQL commands to initialize the database.#



*CLI:* `+--spi-connections-jpa--quarkus--initialize-empty+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__INITIALIZE_EMPTY+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-jpa--quarkus--migration-export+`# 

[.options-description]#Path for where to write manual database initialization/migration file.#

[#option-extended--spi-connections-jpa--quarkus--migration-export,role="options-extended"]
--




*CLI:* `+--spi-connections-jpa--quarkus--migration-export+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__MIGRATION_EXPORT+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-jpa--quarkus--migration-strategy+`# 

[.options-description]#Strategy to use to migrate database.#

[#option-extended--spi-connections-jpa--quarkus--migration-strategy,role="options-extended"]
--
[.options-description-extended]#Valid values are update, manual and validate. Update will automatically migrate the database schema. Manual will export the required changes to a file with SQL commands that you can manually execute on the database. Validate will simply check if the database is up-to-date.#



*CLI:* `+--spi-connections-jpa--quarkus--migration-strategy+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__MIGRATION_STRATEGY+`
--



|
`+update+` (default), `+manual+`, `+validate+`


|===
== credential
=== keycloak-password
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-credential--keycloak-password--validations-counter-tags+`# 

[.options-description]#Comma-separated list of tags to be used when publishing password validation counter metric.#

[#option-extended--spi-credential--keycloak-password--validations-counter-tags,role="options-extended"]
--




*CLI:* `+--spi-credential--keycloak-password--validations-counter-tags+` +
*Env:* `+KC_SPI_CREDENTIAL__KEYCLOAK_PASSWORD__VALIDATIONS_COUNTER_TAGS+`
--



|
`+realm+`, `+algorithm+`, `+hashing_strength+`, `+outcome+`


|===
== crl-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-crl-storage--infinispan--cache-time+`# 

[.options-description]#Interval in seconds that the CRL is cached.#

[#option-extended--spi-crl-storage--infinispan--cache-time,role="options-extended"]
--
[.options-description-extended]#The next update time of the CRL is always a minimum if present.
Zero or a negative value means CRL is cached until the next update time specified in the CRL (or infinite if the
CRL does not contain the next update).#



*CLI:* `+--spi-crl-storage--infinispan--cache-time+` +
*Env:* `+KC_SPI_CRL_STORAGE__INFINISPAN__CACHE_TIME+`
--



|[.options-default]#`+-1+`# (default) or any `+int+`

|
[.options-key]#`+spi-crl-storage--infinispan--min-time-between-requests+`# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the CRL.#

[#option-extended--spi-crl-storage--infinispan--min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The CRL is not updated
from the URL again until this minimum time has passed since the previous refresh. In theory
this option is never used if the CRL is refreshed correctly in the next update time.
The interval should be a positive number. Default 10 seconds.#



*CLI:* `+--spi-crl-storage--infinispan--min-time-between-requests+` +
*Env:* `+KC_SPI_CRL_STORAGE__INFINISPAN__MIN_TIME_BETWEEN_REQUESTS+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== datastore
=== legacy
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-datastore--legacy--allow-migrate-existing-database-to-snapshot+`# 

[.options-description]#By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.#

[#option-extended--spi-datastore--legacy--allow-migrate-existing-database-to-snapshot,role="options-extended"]
--
[.options-description-extended]#As an attempt of doing this indicates that you are trying to run development server against production database, which can result in a loss or corruption of data, and also does not allow upgrading. If it is really intended, you can use this option, which will allow to use nightly/development server against production database when explicitly switch to true. This option is recommended just in the development environments and should be never used in the production!#



*CLI:* `+--spi-datastore--legacy--allow-migrate-existing-database-to-snapshot+` +
*Env:* `+KC_SPI_DATASTORE__LEGACY__ALLOW_MIGRATE_EXISTING_DATABASE_TO_SNAPSHOT+`
--



|
`+true+`, `+false+` (default)


|===
== dblock
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-dblock--jpa--lock-wait-timeout+`# 

[.options-description]#The maximum time to wait when waiting to release a database lock.#

[#option-extended--spi-dblock--jpa--lock-wait-timeout,role="options-extended"]
--




*CLI:* `+--spi-dblock--jpa--lock-wait-timeout+` +
*Env:* `+KC_SPI_DBLOCK__JPA__LOCK_WAIT_TIMEOUT+`
--



|any `+int+`


|===
== device-representation
=== device-representation
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-device-representation--device-representation--cache-size+`# 

[.options-description]#Sets the maximum number of parsed user-agent values in the local cache.#

[#option-extended--spi-device-representation--device-representation--cache-size,role="options-extended"]
--




*CLI:* `+--spi-device-representation--device-representation--cache-size+` +
*Env:* `+KC_SPI_DEVICE_REPRESENTATION__DEVICE_REPRESENTATION__CACHE_SIZE+`
--



|[.options-default]#`+2048+`# (default) or any `+Integer+`


|===
== events-listener
=== email
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-events-listener--email--exclude-events+`# 

[.options-description]#A comma-separated list of events that should not be sent via email to the user's account.#

[#option-extended--spi-events-listener--email--exclude-events,role="options-extended"]
--




*CLI:* `+--spi-events-listener--email--exclude-events+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__EMAIL__EXCLUDE_EVENTS+`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`

|
[.options-key]#`+spi-events-listener--email--include-events+`# 

[.options-description]#A comma-separated list of events that should be sent via email to the user's account.#

[#option-extended--spi-events-listener--email--include-events,role="options-extended"]
--




*CLI:* `+--spi-events-listener--email--include-events+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__EMAIL__INCLUDE_EVENTS+`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`


|===
=== jboss-logging
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-events-listener--jboss-logging--error-level+`# 

[.options-description]#The log level for error messages.#

[#option-extended--spi-events-listener--jboss-logging--error-level,role="options-extended"]
--




*CLI:* `+--spi-events-listener--jboss-logging--error-level+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__ERROR_LEVEL+`
--



|
`+debug+`, `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+` (default)

|
[.options-key]#`+spi-events-listener--jboss-logging--include-representation+`# 

[.options-description]#When "true" the "representation" field with the JSON admin object is also added to the message.#

[#option-extended--spi-events-listener--jboss-logging--include-representation,role="options-extended"]
--
[.options-description-extended]#The realm should be also configured to include representation for the admin events.#



*CLI:* `+--spi-events-listener--jboss-logging--include-representation+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__INCLUDE_REPRESENTATION+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-events-listener--jboss-logging--quotes+`# 

[.options-description]#The quotes to use for values, it should be one character like " or '.#

[#option-extended--spi-events-listener--jboss-logging--quotes,role="options-extended"]
--
[.options-description-extended]#Use "none" if quotes are not needed.#



*CLI:* `+--spi-events-listener--jboss-logging--quotes+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__QUOTES+`
--



|[.options-default]#`+"+`# (default) or any `+string+`

|
[.options-key]#`+spi-events-listener--jboss-logging--sanitize+`# 

[.options-description]#If true the log messages are sanitized to avoid line breaks.#

[#option-extended--spi-events-listener--jboss-logging--sanitize,role="options-extended"]
--
[.options-description-extended]#If false messages are not sanitized.#



*CLI:* `+--spi-events-listener--jboss-logging--sanitize+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__SANITIZE+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-events-listener--jboss-logging--success-level+`# 

[.options-description]#The log level for success messages.#

[#option-extended--spi-events-listener--jboss-logging--success-level,role="options-extended"]
--




*CLI:* `+--spi-events-listener--jboss-logging--success-level+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__SUCCESS_LEVEL+`
--



|
`+debug+` (default), `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+`


|===
== export
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-export--dir--dir+`# 

[.options-description]#Directory to export to#

[#option-extended--spi-export--dir--dir,role="options-extended"]
--




*CLI:* `+--spi-export--dir--dir+` +
*Env:* `+KC_SPI_EXPORT__DIR__DIR+`
--



|any `+string+`

|
[.options-key]#`+spi-export--dir--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-export--dir--realm-name,role="options-extended"]
--




*CLI:* `+--spi-export--dir--realm-name+` +
*Env:* `+KC_SPI_EXPORT__DIR__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-export--dir--users-export-strategy+`# 

[.options-description]#Users export strategy#

[#option-extended--spi-export--dir--users-export-strategy,role="options-extended"]
--




*CLI:* `+--spi-export--dir--users-export-strategy+` +
*Env:* `+KC_SPI_EXPORT__DIR__USERS_EXPORT_STRATEGY+`
--



|[.options-default]#`+DIFFERENT_FILES+`# (default) or any `+string+`

|
[.options-key]#`+spi-export--dir--users-per-file+`# 

[.options-description]#Users per exported file#

[#option-extended--spi-export--dir--users-per-file,role="options-extended"]
--




*CLI:* `+--spi-export--dir--users-per-file+` +
*Env:* `+KC_SPI_EXPORT__DIR__USERS_PER_FILE+`
--



|[.options-default]#`+50+`# (default) or any `+int+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-export--single-file--file+`# 

[.options-description]#File to export to#

[#option-extended--spi-export--single-file--file,role="options-extended"]
--




*CLI:* `+--spi-export--single-file--file+` +
*Env:* `+KC_SPI_EXPORT__SINGLE_FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-export--single-file--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-export--single-file--realm-name,role="options-extended"]
--




*CLI:* `+--spi-export--single-file--realm-name+` +
*Env:* `+KC_SPI_EXPORT__SINGLE_FILE__REALM_NAME+`
--



|any `+string+`


|===
== group
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-group--jpa--escape-slashes-in-group-path+`# 

[.options-description]#If true slashes `/` in group names are escaped with the character `~` when converted to paths.#

[#option-extended--spi-group--jpa--escape-slashes-in-group-path,role="options-extended"]
--




*CLI:* `+--spi-group--jpa--escape-slashes-in-group-path+` +
*Env:* `+KC_SPI_GROUP__JPA__ESCAPE_SLASHES_IN_GROUP_PATH+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-group--jpa--searchable-attributes+`# 

[.options-description]#The list of attributes separated by comma that are allowed in client attribute searches.#

[#option-extended--spi-group--jpa--searchable-attributes,role="options-extended"]
--




*CLI:* `+--spi-group--jpa--searchable-attributes+` +
*Env:* `+KC_SPI_GROUP__JPA__SEARCHABLE_ATTRIBUTES+`
--



|any `+string+`


|===
== import
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-import--dir--dir+`# 

[.options-description]#Directory to import from#

[#option-extended--spi-import--dir--dir,role="options-extended"]
--




*CLI:* `+--spi-import--dir--dir+` +
*Env:* `+KC_SPI_IMPORT__DIR__DIR+`
--



|any `+string+`

|
[.options-key]#`+spi-import--dir--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-import--dir--realm-name,role="options-extended"]
--




*CLI:* `+--spi-import--dir--realm-name+` +
*Env:* `+KC_SPI_IMPORT__DIR__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-import--dir--strategy+`# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended--spi-import--dir--strategy,role="options-extended"]
--




*CLI:* `+--spi-import--dir--strategy+` +
*Env:* `+KC_SPI_IMPORT__DIR__STRATEGY+`
--



|any `+string+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-import--single-file--file+`# 

[.options-description]#File to import from#

[#option-extended--spi-import--single-file--file,role="options-extended"]
--




*CLI:* `+--spi-import--single-file--file+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-import--single-file--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-import--single-file--realm-name,role="options-extended"]
--




*CLI:* `+--spi-import--single-file--realm-name+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-import--single-file--strategy+`# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended--spi-import--single-file--strategy,role="options-extended"]
--




*CLI:* `+--spi-import--single-file--strategy+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__STRATEGY+`
--



|any `+string+`


|===
== jgroups-mtls
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-jgroups-mtls--default--enabled+`# 

[.options-description]#Encrypts the network communication between Keycloak servers.#

[#option-extended--spi-jgroups-mtls--default--enabled,role="options-extended"]
--
[.options-description-extended]#If no additional parameters about a keystore and truststore are provided, ephemeral key pairs and certificates are created and rotated automatically, which is recommended for standard setups.#



*CLI:* `+--spi-jgroups-mtls--default--enabled+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__ENABLED+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-jgroups-mtls--default--keystore-file+`# 

[.options-description]#The Keystore file path.#

[#option-extended--spi-jgroups-mtls--default--keystore-file,role="options-extended"]
--
[.options-description-extended]#The Keystore must contain the certificate to use by the TLS protocol. By default, it looks up `cache-mtls-keystore.p12` under conf/ directory.#



*CLI:* `+--spi-jgroups-mtls--default--keystore-file+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__KEYSTORE_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-jgroups-mtls--default--keystore-password+`# 

[.options-description]#The password to access the Keystore.#

[#option-extended--spi-jgroups-mtls--default--keystore-password,role="options-extended"]
--




*CLI:* `+--spi-jgroups-mtls--default--keystore-password+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__KEYSTORE_PASSWORD+`
--



|any `+Password+`

|
[.options-key]#`+spi-jgroups-mtls--default--rotation+`# 

[.options-description]#Rotation period in days of automatic JGroups MTLS certificates.#

[#option-extended--spi-jgroups-mtls--default--rotation,role="options-extended"]
--




*CLI:* `+--spi-jgroups-mtls--default--rotation+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__ROTATION+`
--



|[.options-default]#`+30+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-jgroups-mtls--default--truststore-file+`# 

[.options-description]#The Truststore file path.#

[#option-extended--spi-jgroups-mtls--default--truststore-file,role="options-extended"]
--
[.options-description-extended]#It should contain the trusted certificates or the Certificate Authority that signed the certificates. By default, it lookup `cache-mtls-truststore.p12` under conf/ directory.#



*CLI:* `+--spi-jgroups-mtls--default--truststore-file+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__TRUSTSTORE_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-jgroups-mtls--default--truststore-password+`# 

[.options-description]#The password to access the Truststore.#

[#option-extended--spi-jgroups-mtls--default--truststore-password,role="options-extended"]
--




*CLI:* `+--spi-jgroups-mtls--default--truststore-password+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__TRUSTSTORE_PASSWORD+`
--



|any `+Password+`


|===
== load-balancer-check
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-load-balancer-check--remote--poll-interval+`# 

[.options-description]#The Remote caches poll interval, in milliseconds, for connection availability#

[#option-extended--spi-load-balancer-check--remote--poll-interval,role="options-extended"]
--




*CLI:* `+--spi-load-balancer-check--remote--poll-interval+` +
*Env:* `+KC_SPI_LOAD_BALANCER_CHECK__REMOTE__POLL_INTERVAL+`
--



|[.options-default]#`+5000+`# (default) or any `+int+`


|===
== login-protocol
=== openid-connect
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-login-protocol--openid-connect--add-req-params-fail-fast+`# 

[.options-description]#Whether the fail-fast strategy should be enforced in case if the limit for some standard OIDC parameter or additional OIDC parameter is not met for the parameters sent to the OIDC authentication request.#

[#option-extended--spi-login-protocol--openid-connect--add-req-params-fail-fast,role="options-extended"]
--
[.options-description-extended]#If false, then all additional request parameters to not meet the configuration are silently ignored. If true, an exception will be raised and OIDC authentication request will not be allowed.#



*CLI:* `+--spi-login-protocol--openid-connect--add-req-params-fail-fast+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__ADD_REQ_PARAMS_FAIL_FAST+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-login-protocol--openid-connect--add-req-params-max-number+`# 

[.options-description]#Maximum number of additional request parameters sent to the OIDC authentication request.#

[#option-extended--spi-login-protocol--openid-connect--add-req-params-max-number,role="options-extended"]
--
[.options-description-extended]#As 'additional request parameter' is meant some custom parameter not directly treated as standard OIDC/OAuth2 protocol parameter. Additional parameters might be useful for example to add custom claims to the OIDC token (in case that also particular protocol mappers are configured).#



*CLI:* `+--spi-login-protocol--openid-connect--add-req-params-max-number+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__ADD_REQ_PARAMS_MAX_NUMBER+`
--



|[.options-default]#`+5+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-protocol--openid-connect--add-req-params-max-overall-size+`# 

[.options-description]#Maximum size of all additional request parameters values together.#

[#option-extended--spi-login-protocol--openid-connect--add-req-params-max-overall-size,role="options-extended"]
--
[.options-description-extended]#See `add-req-params-max-number` for more details about additional request parameters#



*CLI:* `+--spi-login-protocol--openid-connect--add-req-params-max-overall-size+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__ADD_REQ_PARAMS_MAX_OVERALL_SIZE+`
--



|[.options-default]#`+2147483647+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-protocol--openid-connect--add-req-params-max-size+`# 

[.options-description]#Maximum size of single additional request parameter value See `add-req-params-max-number` for more details about additional request parameters#

[#option-extended--spi-login-protocol--openid-connect--add-req-params-max-size,role="options-extended"]
--




*CLI:* `+--spi-login-protocol--openid-connect--add-req-params-max-size+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__ADD_REQ_PARAMS_MAX_SIZE+`
--



|[.options-default]#`+2000+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-protocol--openid-connect--req-params-default-max-size+`# 

[.options-description]#Maximum default length of the standard OIDC parameter sent to the OIDC authentication request.#

[#option-extended--spi-login-protocol--openid-connect--req-params-default-max-size,role="options-extended"]
--
[.options-description-extended]#This applies to most of the standard parameters like for example `state`, `nonce` etc. The exception is `login_hint` parameter, which has maximum length of 255 characters.#



*CLI:* `+--spi-login-protocol--openid-connect--req-params-default-max-size+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__REQ_PARAMS_DEFAULT_MAX_SIZE+`
--



|[.options-default]#`+4000+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-protocol--openid-connect--req-params-max-size--login_hint+`# 

[.options-description]#Maximum length of the standard OIDC authentication request parameter overriden for the specified parameter.#

[#option-extended--spi-login-protocol--openid-connect--req-params-max-size--login_hint,role="options-extended"]
--
[.options-description-extended]#Useful if some standard OIDC parameter should have different limit than `req-params-default-max-size`. It is needed to add the name of the parameter after this prefix into the configuration. In this example, the `login_hint` parameter is used, but this format is supported for any known standard OIDC/OAuth2 parameter.#



*CLI:* `+--spi-login-protocol--openid-connect--req-params-max-size--login_hint+` +
*Env:* `+KC_SPI_LOGIN_PROTOCOL__OPENID_CONNECT__REQ_PARAMS_MAX_SIZE__LOGIN_HINT+`
--



|any `+int+`


|===
== login-failure
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-login-failure--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-login-failure--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#



*CLI:* `+--spi-login-failure--remote--max-retries+` +
*Env:* `+KC_SPI_LOGIN_FAILURE__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-failure--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-login-failure--remote--retry-base-time,role="options-extended"]
--




*CLI:* `+--spi-login-failure--remote--retry-base-time+` +
*Env:* `+KC_SPI_LOGIN_FAILURE__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== mapped-diagnostic-context
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-mapped-diagnostic-context--default--mdc-keys+`# 

[.options-description]#Comma-separated list of MDC keys to add to the Mapped Diagnostic Context.#

[#option-extended--spi-mapped-diagnostic-context--default--mdc-keys,role="options-extended"]
--




*CLI:* `+--spi-mapped-diagnostic-context--default--mdc-keys+` +
*Env:* `+KC_SPI_MAPPED_DIAGNOSTIC_CONTEXT__DEFAULT__MDC_KEYS+`
--



|
`+realmName+`, `+clientId+`, `+userId+`, `+ipAddress+`, `+org+`, `+sessionId+`, `+authenticationSessionId+`, `+authenticationTabId+`


|===
== password-hashing
=== argon2
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-password-hashing--argon2--cpu-cores+`# 

[.options-description]#Maximum parallel CPU cores to use for hashing#

[#option-extended--spi-password-hashing--argon2--cpu-cores,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--cpu-cores+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__CPU_CORES+`
--



|any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--hash-length+`# 

[.options-description]#Hash length#

[#option-extended--spi-password-hashing--argon2--hash-length,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--hash-length+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__HASH_LENGTH+`
--



|[.options-default]#`+32+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--iterations+`# 

[.options-description]#Iterations#

[#option-extended--spi-password-hashing--argon2--iterations,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--iterations+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__ITERATIONS+`
--



|[.options-default]#`+5+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--memory+`# 

[.options-description]#Memory size (KB)#

[#option-extended--spi-password-hashing--argon2--memory,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--memory+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__MEMORY+`
--



|[.options-default]#`+7168+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--parallelism+`# 

[.options-description]#Parallelism#

[#option-extended--spi-password-hashing--argon2--parallelism,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--parallelism+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__PARALLELISM+`
--



|[.options-default]#`+1+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--type+`# 

[.options-description]#Type#

[#option-extended--spi-password-hashing--argon2--type,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--type+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__TYPE+`
--



|
`+id+` (default), `+d+`, `+i+`

|
[.options-key]#`+spi-password-hashing--argon2--version+`# 

[.options-description]#Version#

[#option-extended--spi-password-hashing--argon2--version,role="options-extended"]
--




*CLI:* `+--spi-password-hashing--argon2--version+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__VERSION+`
--



|
`+1.3+` (default), `+1.0+`


|===
== public-key-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-public-key-storage--infinispan--max-cache-time+`# 

[.options-description]#Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.#

[#option-extended--spi-public-key-storage--infinispan--max-cache-time,role="options-extended"]
--
[.options-description-extended]#When all keys for the entry are retrieved there is no way to detect if a key is missing (different to the case when the key is retrieved via ID for example). In that situation this option forces a refresh from time to time. This time can be overriden by the protocol (for example using cacheDuration or validUntil in the SAML descriptor). Default 24 hours.#



*CLI:* `+--spi-public-key-storage--infinispan--max-cache-time+` +
*Env:* `+KC_SPI_PUBLIC_KEY_STORAGE__INFINISPAN__MAX_CACHE_TIME+`
--



|[.options-default]#`+86400+`# (default) or any `+int+`

|
[.options-key]#`+spi-public-key-storage--infinispan--min-time-between-requests+`# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the new public keys.#

[#option-extended--spi-public-key-storage--infinispan--min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The server will always try to download new public keys when a single key is requested and not found. However it will avoid the download if the previous refresh was done less than 10 seconds ago (by default). This behavior is used to avoid DoS attacks against the external keys endpoint.#



*CLI:* `+--spi-public-key-storage--infinispan--min-time-between-requests+` +
*Env:* `+KC_SPI_PUBLIC_KEY_STORAGE__INFINISPAN__MIN_TIME_BETWEEN_REQUESTS+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== required-action
=== CONFIGURE_RECOVERY_AUTHN_CODES
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_RECOVERY_AUTHN_CODES__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`

|
[.options-key]#`+spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold+`# 

[.options-description]#When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will recommend him to setup new set of recovery codes.#

[#option-extended--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold,role="options-extended"]
--




*CLI:* `+--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_RECOVERY_AUTHN_CODES__WARNING_THRESHOLD+`
--



|[.options-default]#`+4+`# (default) or any `+Integer+`


|===
=== CONFIGURE_TOTP
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--CONFIGURE_TOTP--add-recovery-codes+`# 

[.options-description]#If this option is enabled, the user will be required to configure recovery codes following the OTP configuration.#

[#option-extended--spi-required-action--CONFIGURE_TOTP--add-recovery-codes,role="options-extended"]
--
[.options-description-extended]#If the user already has recovery codes configured, Keycloak will not ask for setting them up.
As a prerequisite, enable the recovery codes required action and enable recovery codes in your authentication flow.#



*CLI:* `+--spi-required-action--CONFIGURE_TOTP--add-recovery-codes+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_TOTP__ADD_RECOVERY_CODES+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-required-action--CONFIGURE_TOTP--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--CONFIGURE_TOTP--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--CONFIGURE_TOTP--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_TOTP__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== TERMS_AND_CONDITIONS
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--TERMS_AND_CONDITIONS--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--TERMS_AND_CONDITIONS--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--TERMS_AND_CONDITIONS--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__TERMS_AND_CONDITIONS__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== UPDATE_EMAIL
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--UPDATE_EMAIL--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--UPDATE_EMAIL--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--UPDATE_EMAIL--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_EMAIL__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`

|
[.options-key]#`+spi-required-action--UPDATE_EMAIL--verify-email+`# 

[.options-description]#If enabled, the user will be forced to verify the email regardless if email verification is enabled at the realm level or not.#

[#option-extended--spi-required-action--UPDATE_EMAIL--verify-email,role="options-extended"]
--
[.options-description-extended]#Otherwise, verification will be based on the realm level setting.#



*CLI:* `+--spi-required-action--UPDATE_EMAIL--verify-email+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_EMAIL__VERIFY_EMAIL+`
--



|
`+true+`, `+false+` (default)


|===
=== UPDATE_PASSWORD
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--UPDATE_PASSWORD--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--UPDATE_PASSWORD--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--UPDATE_PASSWORD--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_PASSWORD__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== UPDATE_PROFILE
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--UPDATE_PROFILE--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--UPDATE_PROFILE--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--UPDATE_PROFILE--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_PROFILE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== VERIFY_EMAIL
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--VERIFY_EMAIL--email-resend-cooldown-seconds+`# 

[.options-description]#Minimum delay in seconds before another email verification email can be sent.#

[#option-extended--spi-required-action--VERIFY_EMAIL--email-resend-cooldown-seconds,role="options-extended"]
--




*CLI:* `+--spi-required-action--VERIFY_EMAIL--email-resend-cooldown-seconds+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__VERIFY_EMAIL__EMAIL_RESEND_COOLDOWN_SECONDS+`
--



|[.options-default]#`+30+`# (default) or any `+String+`

|
[.options-key]#`+spi-required-action--VERIFY_EMAIL--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--VERIFY_EMAIL--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--VERIFY_EMAIL--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__VERIFY_EMAIL__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== VERIFY_PROFILE
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--VERIFY_PROFILE--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--VERIFY_PROFILE--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--VERIFY_PROFILE--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__VERIFY_PROFILE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== delete_credential
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--delete_credential--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--delete_credential--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--delete_credential--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__DELETE_CREDENTIAL__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== idp_link
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--idp_link--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--idp_link--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--idp_link--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__IDP_LINK__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== update_user_locale
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--update_user_locale--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--update_user_locale--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--update_user_locale--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_USER_LOCALE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== webauthn-register
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--webauthn-register--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--webauthn-register--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--webauthn-register--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__WEBAUTHN_REGISTER__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== webauthn-register-passwordless
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--webauthn-register-passwordless--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--webauthn-register-passwordless--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#



*CLI:* `+--spi-required-action--webauthn-register-passwordless--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__WEBAUTHN_REGISTER_PASSWORDLESS__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
== resource-encoding
=== gzip
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-resource-encoding--gzip--excluded-content-types+`# 

[.options-description]#A space separated list of content-types to exclude from encoding.#

[#option-extended--spi-resource-encoding--gzip--excluded-content-types,role="options-extended"]
--




*CLI:* `+--spi-resource-encoding--gzip--excluded-content-types+` +
*Env:* `+KC_SPI_RESOURCE_ENCODING__GZIP__EXCLUDED_CONTENT_TYPES+`
--



|[.options-default]#`+image/png image/jpeg+`# (default) or any `+string+`


|===
== security-profile
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-security-profile--default--name+`# 

[.options-description]#Name for the security configuration file to use.#

[#option-extended--spi-security-profile--default--name,role="options-extended"]
--
[.options-description-extended]#File `name`.json is searched in classapth and `conf` installation folder.#



*CLI:* `+--spi-security-profile--default--name+` +
*Env:* `+KC_SPI_SECURITY_PROFILE__DEFAULT__NAME+`
--



|any `+string+`


|===
== single-use-object
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-single-use-object--infinispan--persist-revoked-tokens+`# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended--spi-single-use-object--infinispan--persist-revoked-tokens,role="options-extended"]
--




*CLI:* `+--spi-single-use-object--infinispan--persist-revoked-tokens+` +
*Env:* `+KC_SPI_SINGLE_USE_OBJECT__INFINISPAN__PERSIST_REVOKED_TOKENS+`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-single-use-object--remote--persist-revoked-tokens+`# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended--spi-single-use-object--remote--persist-revoked-tokens,role="options-extended"]
--




*CLI:* `+--spi-single-use-object--remote--persist-revoked-tokens+` +
*Env:* `+KC_SPI_SINGLE_USE_OBJECT__REMOTE__PERSIST_REVOKED_TOKENS+`
--



|
`+true+` (default), `+false+`


|===
== sticky-session-encoder
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-sticky-session-encoder--infinispan--should-attach-route+`# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended--spi-sticky-session-encoder--infinispan--should-attach-route,role="options-extended"]
--




*CLI:* `+--spi-sticky-session-encoder--infinispan--should-attach-route+` +
*Env:* `+KC_SPI_STICKY_SESSION_ENCODER__INFINISPAN__SHOULD_ATTACH_ROUTE+`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-sticky-session-encoder--remote--should-attach-route+`# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended--spi-sticky-session-encoder--remote--should-attach-route,role="options-extended"]
--




*CLI:* `+--spi-sticky-session-encoder--remote--should-attach-route+` +
*Env:* `+KC_SPI_STICKY_SESSION_ENCODER__REMOTE__SHOULD_ATTACH_ROUTE+`
--



|
`+true+` (default), `+false+`


|===
== truststore
=== file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-truststore--file--file+`# 

[.options-description]#DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.#

[#option-extended--spi-truststore--file--file,role="options-extended"]
--




*CLI:* `+--spi-truststore--file--file+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-truststore--file--hostname-verification-policy+`# 

[.options-description]#DEPRECATED: The hostname verification policy.#

[#option-extended--spi-truststore--file--hostname-verification-policy,role="options-extended"]
--




*CLI:* `+--spi-truststore--file--hostname-verification-policy+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__HOSTNAME_VERIFICATION_POLICY+`
--



|
`+ANY+`, `+WILDCARD+`, `+STRICT+`, `+DEFAULT+` (default)

|
[.options-key]#`+spi-truststore--file--password+`# 

[.options-description]#DEPRECATED: The trust store password.#

[#option-extended--spi-truststore--file--password,role="options-extended"]
--




*CLI:* `+--spi-truststore--file--password+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-truststore--file--type+`# 

[.options-description]#DEPRECATED: Type of the truststore.#

[#option-extended--spi-truststore--file--type,role="options-extended"]
--
[.options-description-extended]#If not provided, the type would be detected based on the truststore file extension or platform default type.#



*CLI:* `+--spi-truststore--file--type+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__TYPE+`
--



|any `+string+`


|===
== user-profile
=== declarative-user-profile
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-profile--declarative-user-profile--admin-read-only-attributes+`# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so administrators can't change them.#

[#option-extended--spi-user-profile--declarative-user-profile--admin-read-only-attributes,role="options-extended"]
--




*CLI:* `+--spi-user-profile--declarative-user-profile--admin-read-only-attributes+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__ADMIN_READ_ONLY_ATTRIBUTES+`
--



|any `+MultivaluedString+`

|
[.options-key]#`+spi-user-profile--declarative-user-profile--max-email-local-part-length+`# 

[.options-description]#To set user profile max email local part length#

[#option-extended--spi-user-profile--declarative-user-profile--max-email-local-part-length,role="options-extended"]
--




*CLI:* `+--spi-user-profile--declarative-user-profile--max-email-local-part-length+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__MAX_EMAIL_LOCAL_PART_LENGTH+`
--



|any `+String+`

|
[.options-key]#`+spi-user-profile--declarative-user-profile--read-only-attributes+`# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so users can't change them.#

[#option-extended--spi-user-profile--declarative-user-profile--read-only-attributes,role="options-extended"]
--




*CLI:* `+--spi-user-profile--declarative-user-profile--read-only-attributes+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__READ_ONLY_ATTRIBUTES+`
--



|any `+MultivaluedString+`


|===
== user-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-sessions--infinispan--max-batch-size+`# 

[.options-description]#Maximum size of a batch (only applicable to persistent sessions#

[#option-extended--spi-user-sessions--infinispan--max-batch-size,role="options-extended"]
--




*CLI:* `+--spi-user-sessions--infinispan--max-batch-size+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__MAX_BATCH_SIZE+`
--



|[.options-default]#`+4+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override+`# 

[.options-description]#Override how long offline client sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)#

[#option-extended--spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override,role="options-extended"]
--




*CLI:* `+--spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__OFFLINE_CLIENT_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE+`
--



|any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override+`# 

[.options-description]#Override how long offline user sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)#

[#option-extended--spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override,role="options-extended"]
--




*CLI:* `+--spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__OFFLINE_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE+`
--



|any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--use-batches+`# 

[.options-description]#Enable or disable batch writes to the database.#

[#option-extended--spi-user-sessions--infinispan--use-batches,role="options-extended"]
--
[.options-description-extended]#Enabled by default with the persistent-user-sessions Feature#



*CLI:* `+--spi-user-sessions--infinispan--use-batches+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__USE_BATCHES+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-user-sessions--infinispan--use-caches+`# 

[.options-description]#Enable or disable caches.#

[#option-extended--spi-user-sessions--infinispan--use-caches,role="options-extended"]
--
[.options-description-extended]#Enabled by default unless the external feature to use only external remote caches is used#



*CLI:* `+--spi-user-sessions--infinispan--use-caches+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__USE_CACHES+`
--



|
`+true+`, `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-sessions--remote--batch-size+`# 

[.options-description]#Batch size when streaming session from the remote cache#

[#option-extended--spi-user-sessions--remote--batch-size,role="options-extended"]
--




*CLI:* `+--spi-user-sessions--remote--batch-size+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__BATCH_SIZE+`
--



|[.options-default]#`+1024+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-user-sessions--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#



*CLI:* `+--spi-user-sessions--remote--max-retries+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-user-sessions--remote--retry-base-time,role="options-extended"]
--




*CLI:* `+--spi-user-sessions--remote--retry-base-time+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== well-known
=== oauth-authorization-server
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-well-known--oauth-authorization-server--include-client-scopes+`# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended--spi-well-known--oauth-authorization-server--include-client-scopes,role="options-extended"]
--




*CLI:* `+--spi-well-known--oauth-authorization-server--include-client-scopes+` +
*Env:* `+KC_SPI_WELL_KNOWN__OAUTH_AUTHORIZATION_SERVER__INCLUDE_CLIENT_SCOPES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-well-known--oauth-authorization-server--openid-configuration-override+`# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended--spi-well-known--oauth-authorization-server--openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#



*CLI:* `+--spi-well-known--oauth-authorization-server--openid-configuration-override+` +
*Env:* `+KC_SPI_WELL_KNOWN__OAUTH_AUTHORIZATION_SERVER__OPENID_CONFIGURATION_OVERRIDE+`
--



|any `+string+`


|===
=== openid-configuration
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-well-known--openid-configuration--include-client-scopes+`# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended--spi-well-known--openid-configuration--include-client-scopes,role="options-extended"]
--




*CLI:* `+--spi-well-known--openid-configuration--include-client-scopes+` +
*Env:* `+KC_SPI_WELL_KNOWN__OPENID_CONFIGURATION__INCLUDE_CLIENT_SCOPES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-well-known--openid-configuration--openid-configuration-override+`# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended--spi-well-known--openid-configuration--openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#



*CLI:* `+--spi-well-known--openid-configuration--openid-configuration-override+` +
*Env:* `+KC_SPI_WELL_KNOWN__OPENID_CONFIGURATION__OPENID_CONFIGURATION_OVERRIDE+`
--



|any `+string+`


|===


