## Children (2)

- credential
- redirect-rewrite-rule

## Attributes (57)

- adapter-state-cookie-path - If set, this defines the path used in cookies set by the subsystem. This is useful when deploying an application in the root context path.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "If set, this defines the path used in cookies set by the subsystem. This is useful when deploying an application in the root context path.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- allow-any-hostname - If set to 'true', hostname verification is skipped when communicating with the OpenID provider over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', hostname verification is skipped when communicating with the OpenID provider over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- always-refresh-token - If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to the OpenID provider to obtain a new access token. This can result in a higher load on the OpenID provider and may impact the performance of the application.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to the OpenID provider to obtain a new access token. This can result in a higher load on the OpenID provider and may impact the performance of the application.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- auth-server-url - The base URL of the Keycloak authorization server. This is Keycloak-specific. It is recommended to use 'provider-url' instead.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The base URL of the Keycloak authorization server. This is Keycloak-specific. It is recommended to use 'provider-url' instead.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "alternatives" : ["provider-url"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 authentication-request-format - The format to use for specifying query parameters in authentication request.

  Type | STRING
  Default Value | oauth2
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Allowed Values | request oauth2 request_uri
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The format to use for specifying query parameters in authentication request.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : "oauth2",
          "allowed" : [
              "oauth2",
              "request",
              "request_uri"
          ],
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- autodetect-bearer-only - Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the OpenID provider login page. Set the value to 'true' if your application serves both applications and web services.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the OpenID provider login page. Set the value to 'true' if your application serves both applications and web services.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- bearer-only - Enable Bearer-Token only authentication. Set this to 'true' if your application serves only web services and does not authenticate users.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Enable Bearer-Token only authentication. Set this to 'true' if your application serves only web services and does not authenticate users.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- client-id - The unique identifier for a client application registered in the OpenID provider.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The unique identifier for a client application registered in the OpenID provider.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "alternatives" : ["resource"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- client-key-password - The password for the client key. This is required if 'client-keystore' has been specified.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The password for the client key. This is required if 'client-keystore' has been specified.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- client-keystore - The path to the client keystore to use when communicating with the OpenID provider over HTTPS. This is optional.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The path to the client keystore to use when communicating with the OpenID provider over HTTPS. This is optional.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- client-keystore-password - The password for the client keystore. This is required if 'client-keystore' has been specified.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The password for the client keystore. This is required if 'client-keystore' has been specified.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- confidential-port - The confidential port used by the OpenID provider when communicating securely over SSL/TLS.

  Type | INT
  Default Value | 8443
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "The confidential port used by the OpenID provider when communicating securely over SSL/TLS.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : 8443,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- connection-pool-size - The connection pool size to use when communicating with the OpenID provider.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | 0
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "The connection pool size to use when communicating with the OpenID provider.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : 0,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- connection-timeout-millis - The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.

  Type | LONG
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "LONG"
          },
          "description" : "The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- connection-ttl-millis - The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.

  Type | LONG
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "LONG"
          },
          "description" : "The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- cors-allowed-headers - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- cors-allowed-methods - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- cors-exposed-headers - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- cors-max-age - If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- credential - The credential used to communicate with the OpenID Connect provider.

  Type | OBJECT
  Is the attribute nillable? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "OBJECT"
          },
          "description" : "The credential used to communicate with the OpenID Connect provider.",
          "expressions-allowed" : false,
          "required" : false,
          "nillable" : true,
          "stability" : "default",
          "value-type" : {
              "secret" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The client secret that was registered with the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-keystore-file" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The path to the client keystore when the credential provider is used. This is optional.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-keystore-type" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The client keystore type when the credential provider is used.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-keystore-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The password for the client keystore when the credential provider is used. This is required if 'client-keystore-file' has been specified.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-key-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The password for the client key when the credential provider is used. This is required if 'client-keystore-file' has been specified.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "token-timeout" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "The amount of time after which the token expires and can no longer be used to authenticate requests.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : 1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "client-key-alias" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The client key alias when the credential provider is used.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "algorithm" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The credential signature algorithm used by the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              }
          },
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- disable-trust-manager - Whether or not to make use of a trust manager when communicating with the OpenID provider over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Whether or not to make use of a trust manager when communicating with the OpenID provider over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- enable-basic-auth - Enable Basic authentication. This is not supported in the current release.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Enable Basic authentication. This is not supported in the current release.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- enable-cors - Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional. This is Keycloak-specific.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional. This is Keycloak-specific.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- expose-token - If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- ignore-oauth-query-parameter - Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- min-time-between-jwks-requests - If the subsystem recognizes a token signed by an unknown public key, it will try to download a new public key from the server. The subsystem won't try to download a public key if it already tried last in less than 'min-time-between-jwks-requests' seconds.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "If the subsystem recognizes a token signed by an unknown public key, it will try to download a new public key from the server. The subsystem won't try to download a public key if it already tried last in less than 'min-time-between-jwks-requests' seconds.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- principal-attribute - Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- provider - The OpenID Connect provider to use for authentication.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The OpenID Connect provider to use for authentication.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- provider-url - The OpenID provider URL.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The OpenID provider URL.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "alternatives" : ["auth-server-url"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- proxy-url - The URL for the HTTP proxy if one is used.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The URL for the HTTP proxy if one is used.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- public-client - If set to 'true', no client credentials are sent when communicating with the OpenID provider.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', no client credentials are sent when communicating with the OpenID provider.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- public-key-cache-ttl - The maximum interval between two requests to retrieve new public keys in seconds. New public keys are downloaded when the subsystem recognizes a token signed by an unknown public key. Even if the token's key is already known, new public keys are downloaded periodically as per the interval set here at least once.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "The maximum interval between two requests to retrieve new public keys in seconds. New public keys are downloaded when the subsystem recognizes a token signed by an unknown public key. Even if the token's key is already known, new public keys are downloaded periodically as per the interval set here at least once.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- realm - The Keycloak realm to use for authentication.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The Keycloak realm to use for authentication.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- realm-public-key - The public key of the OpenID provider in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from the OpenID provider when needed. If the public key is set, the subsystem never downloads new keys from the OpenID provider, breaking the subsystem when the OpenID provider rotates its keys.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The public key of the OpenID provider in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from the OpenID provider when needed. If the public key is set, the subsystem never downloads new keys from the OpenID provider, breaking the subsystem when the OpenID provider rotates its keys.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- redirect-rewrite-rule - The rewrite rule for the redirect URI. The rewrite rule is an object notation, where the key is a regular expression with which the redirect URI is matched and the value is the replacement String.

  Type | OBJECT
  Is the attribute nillable? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "OBJECT"
          },
          "description" : "The rewrite rule for the redirect URI. The rewrite rule is an object notation, where the key is a regular expression with which the redirect URI is matched and the value is the replacement String.",
          "expressions-allowed" : false,
          "required" : false,
          "nillable" : true,
          "stability" : "default",
          "value-type" : {"replacement" : {
              "type" : {
                  "TYPE_MODEL_VALUE" : "STRING"
              },
              "description" : "The replacement String in the rewrite rule for the redirect URI.",
              "expressions-allowed" : true,
              "required" : false,
              "nillable" : true,
              "min-length" : 1,
              "max-length" : 2147483647,
              "stability" : "default"
          }},
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- register-node-at-startup - If set to 'true', the subsystem sends a registration request to the OpenID provider. This attribute is useful only when your application is clustered.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', the subsystem sends a registration request to the OpenID provider. This attribute is useful only when your application is clustered.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- register-node-period - If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-encryption-alg-value - The encryption algorithm used to encrypt the request object.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The encryption algorithm used to encrypt the request object.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "requires" : ["request-object-encryption-enc-value"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-encryption-enc-value - The content encryption algorithm used to encrypt the request object.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The content encryption algorithm used to encrypt the request object.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "requires" : ["request-object-encryption-alg-value"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-algorithm - The algorithm used to sign the request object. The default value fot this attribute is "none".

  Type | STRING
  Default Value | none
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The algorithm used to sign the request object. The default value fot this attribute is \"none\".",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : "none",
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-key-alias - The key alias when a key pair is used to sign request objects.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The key alias when a key pair is used to sign request objects.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-key-password - The key password when a key pair is used to sign request objects.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The key password when a key pair is used to sign request objects.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-keystore-file - The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-keystore-password - The keystore password when a key pair is used to sign request objects.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The keystore password when a key pair is used to sign request objects.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 request-object-signing-keystore-type - The keystore type used to specify the client key pair used to sign request objects.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The keystore type used to specify the client key pair used to sign request objects.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- resource - The unique, legacy identifier for a client application registered in the OpenID provider. It is recommended to use the 'client-id'.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The unique, legacy identifier for a client application registered in the OpenID provider. It is recommended to use the 'client-id'.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "alternatives" : ["client-id"],
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- 🅿 scope - A space separated list of scope values that should be used in the OIDC authentication request. Scopes can be used to request that specific sets of information be made available as Claim Values.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | preview
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "A space separated list of scope values that should be used in the OIDC authentication request. Scopes can be used to request that specific sets of information be made available as Claim Values.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "preview",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- socket-timeout-millis - The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.

  Type | LONG
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "LONG"
          },
          "description" : "The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- ssl-required - Whether the communication with the OpenID provider should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.

  Type | STRING
  Default Value | external
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Allowed Values | ALL EXTERNAL NONE
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "Whether the communication with the OpenID provider should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : "external",
          "allowed" : [
              "ALL",
              "EXTERNAL",
              "NONE"
          ],
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- token-minimum-time-to-live - The subsystem will refresh the token if it will expire within the duration specified in 'token-minimum-time-to-live' seconds. This value should never exceed the access token lifespan. If the value is set to 0 seconds, the subsystem will refresh the token only if the token has expired.

  Type | INT
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Min | -1
  Max | 2147483647
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "INT"
          },
          "description" : "The subsystem will refresh the token if it will expire within the duration specified in 'token-minimum-time-to-live' seconds. This value should never exceed the access token lifespan. If the value is set to 0 seconds, the subsystem will refresh the token only if the token has expired.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min" : -1,
          "max" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- token-signature-algorithm - The token signature algorithm used by the OpenID provider.

  Type | STRING
  Default Value | RS256
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The token signature algorithm used by the OpenID provider.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : "RS256",
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- token-store - Defines whether to store account information in an HTTP session or in a cookie.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "Defines whether to store account information in an HTTP session or in a cookie.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- truststore - The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- truststore-password - The password for the truststore.

  Type | STRING
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "STRING"
          },
          "description" : "The password for the truststore.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "min-length" : 1,
          "max-length" : 2147483647,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- turn-off-change-session-id-on-login - The Session ID is changed by default on a successful login. Set this to 'true' if you want to turn this off.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "The Session ID is changed by default on a successful login. Set this to 'true' if you want to turn this off.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- use-resource-role-mappings - If set to 'true', the subsystem will look inside the token for application-level role mappings for a user. If set to 'false', the subsystem will look at the realm-level for user-role mappings. This is optional.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', the subsystem will look inside the token for application-level role mappings for a user. If set to 'false', the subsystem will look at the realm-level for user-role mappings. This is optional.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

- verify-token-audience - If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set the value to 'true' for improved security.

  Type | BOOLEAN
  Default Value | false
  Is the attribute nillable? | true
  Does the attribute allow expression? | true
  Where is the attribute stored? | configuration
  Access Type | read-write
  Is restarted required? | no-services
  Stability Level | default
  Raw DMR model |
      {
          "type" : {
              "TYPE_MODEL_VALUE" : "BOOLEAN"
          },
          "description" : "If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set the value to 'true' for improved security.",
          "expressions-allowed" : true,
          "required" : false,
          "nillable" : true,
          "default" : false,
          "stability" : "default",
          "access-type" : "read-write",
          "storage" : "configuration",
          "restart-required" : "no-services",
          "capability-reference" : null
      }

## Operations (2)

- add - Add a deployment to be secured by an OpenID Connect provider.

  Request Parameter | Type | Required | Expressions Allowed | Default value | Description
  --- | --- | --- | --- | --- | ---
  adapter-state-cookie-path | STRING | false | true |  | If set, this defines the path used in cookies set by the subsystem. This is useful when deploying an application in the root context path.
  allow-any-hostname | BOOLEAN | false | true | false | If set to 'true', hostname verification is skipped when communicating with the OpenID provider over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.
  always-refresh-token | BOOLEAN | false | true | false | If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to the OpenID provider to obtain a new access token. This can result in a higher load on the OpenID provider and may impact the performance of the application.
  auth-server-url | STRING | false | true |  | The base URL of the Keycloak authorization server. This is Keycloak-specific. It is recommended to use 'provider-url' instead.
  authentication-request-format | STRING | false | true | oauth2 | The format to use for specifying query parameters in authentication request.
  autodetect-bearer-only | BOOLEAN | false | true | false | Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the OpenID provider login page. Set the value to 'true' if your application serves both applications and web services.
  bearer-only | BOOLEAN | false | true | false | Enable Bearer-Token only authentication. Set this to 'true' if your application serves only web services and does not authenticate users.
  client-id | STRING | false | true |  | The unique identifier for a client application registered in the OpenID provider.
  client-key-password | STRING | false | true |  | The password for the client key. This is required if 'client-keystore' has been specified.
  client-keystore | STRING | false | true |  | The path to the client keystore to use when communicating with the OpenID provider over HTTPS. This is optional.
  client-keystore-password | STRING | false | true |  | The password for the client keystore. This is required if 'client-keystore' has been specified.
  confidential-port | INT | false | true | 8443 | The confidential port used by the OpenID provider when communicating securely over SSL/TLS.
  connection-pool-size | INT | false | true |  | The connection pool size to use when communicating with the OpenID provider.
  connection-timeout-millis | LONG | false | true |  | The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.
  connection-ttl-millis | LONG | false | true |  | The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.
  cors-allowed-headers | STRING | false | true |  | If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
  cors-allowed-methods | STRING | false | true |  | If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
  cors-exposed-headers | STRING | false | true |  | If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.
  cors-max-age | INT | false | true |  | If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.
  credential | OBJECT | false | false |  | The credential used to communicate with the OpenID Connect provider.
  disable-trust-manager | BOOLEAN | false | true | false | Whether or not to make use of a trust manager when communicating with the OpenID provider over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.
  enable-basic-auth | BOOLEAN | false | true | false | Enable Basic authentication. This is not supported in the current release.
  enable-cors | BOOLEAN | false | true | false | Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional. This is Keycloak-specific.
  expose-token | BOOLEAN | false | true | false | If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.
  ignore-oauth-query-parameter | BOOLEAN | false | true | false | Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.
  min-time-between-jwks-requests | INT | false | true |  | If the subsystem recognizes a token signed by an unknown public key, it will try to download a new public key from the server. The subsystem won't try to download a public key if it already tried last in less than 'min-time-between-jwks-requests' seconds.
  principal-attribute | STRING | false | true |  | Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.
  provider | STRING | false | true |  | The OpenID Connect provider to use for authentication.
  provider-url | STRING | false | true |  | The OpenID provider URL.
  proxy-url | STRING | false | true |  | The URL for the HTTP proxy if one is used.
  public-client | BOOLEAN | false | true | false | If set to 'true', no client credentials are sent when communicating with the OpenID provider.
  public-key-cache-ttl | INT | false | true |  | The maximum interval between two requests to retrieve new public keys in seconds. New public keys are downloaded when the subsystem recognizes a token signed by an unknown public key. Even if the token's key is already known, new public keys are downloaded periodically as per the interval set here at least once.
  realm | STRING | false | true |  | The Keycloak realm to use for authentication.
  realm-public-key | STRING | false | true |  | The public key of the OpenID provider in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from the OpenID provider when needed. If the public key is set, the subsystem never downloads new keys from the OpenID provider, breaking the subsystem when the OpenID provider rotates its keys.
  redirect-rewrite-rule | OBJECT | false | false |  | The rewrite rule for the redirect URI. The rewrite rule is an object notation, where the key is a regular expression with which the redirect URI is matched and the value is the replacement String.
  register-node-at-startup | BOOLEAN | false | true | false | If set to 'true', the subsystem sends a registration request to the OpenID provider. This attribute is useful only when your application is clustered.
  register-node-period | INT | false | true |  | If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.
  request-object-encryption-alg-value | STRING | false | true |  | The encryption algorithm used to encrypt the request object.
  request-object-encryption-enc-value | STRING | false | true |  | The content encryption algorithm used to encrypt the request object.
  request-object-signing-algorithm | STRING | false | true | none | The algorithm used to sign the request object. The default value fot this attribute is "none".
  request-object-signing-key-alias | STRING | false | true |  | The key alias when a key pair is used to sign request objects.
  request-object-signing-key-password | STRING | false | true |  | The key password when a key pair is used to sign request objects.
  request-object-signing-keystore-file | STRING | false | true |  | The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.
  request-object-signing-keystore-password | STRING | false | true |  | The keystore password when a key pair is used to sign request objects.
  request-object-signing-keystore-type | STRING | false | true |  | The keystore type used to specify the client key pair used to sign request objects.
  resource | STRING | false | true |  | The unique, legacy identifier for a client application registered in the OpenID provider. It is recommended to use the 'client-id'.
  scope | STRING | false | true |  | A space separated list of scope values that should be used in the OIDC authentication request. Scopes can be used to request that specific sets of information be made available as Claim Values.
  socket-timeout-millis | LONG | false | true |  | The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.
  ssl-required | STRING | false | true | external | Whether the communication with the OpenID provider should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.
  token-minimum-time-to-live | INT | false | true |  | The subsystem will refresh the token if it will expire within the duration specified in 'token-minimum-time-to-live' seconds. This value should never exceed the access token lifespan. If the value is set to 0 seconds, the subsystem will refresh the token only if the token has expired.
  token-signature-algorithm | STRING | false | true | RS256 | The token signature algorithm used by the OpenID provider.
  token-store | STRING | false | true |  | Defines whether to store account information in an HTTP session or in a cookie.
  truststore | STRING | false | true |  | The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.
  truststore-password | STRING | false | true |  | The password for the truststore.
  turn-off-change-session-id-on-login | BOOLEAN | false | true | false | The Session ID is changed by default on a successful login. Set this to 'true' if you want to turn this off.
  use-resource-role-mappings | BOOLEAN | false | true | false | If set to 'true', the subsystem will look inside the token for application-level role mappings for a user. If set to 'false', the subsystem will look at the realm-level for user-role mappings. This is optional.
  verify-token-audience | BOOLEAN | false | true | false | If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set the value to 'true' for improved security.

  Raw DMR model |
      {
          "operation-name" : "add",
          "description" : "Add a deployment to be secured by an OpenID Connect provider.",
          "request-properties" : {
              "adapter-state-cookie-path" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "If set, this defines the path used in cookies set by the subsystem. This is useful when deploying an application in the root context path.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "allow-any-hostname" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', hostname verification is skipped when communicating with the OpenID provider over HTTPS. This can be useful in testing environments. This should never be set to 'true' in production environments as it disables verification of SSL certificates.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "always-refresh-token" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', the subsystem refreshes the token every time your application receives a web request, and a new request is sent to the OpenID provider to obtain a new access token. This can result in a higher load on the OpenID provider and may impact the performance of the application.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "auth-server-url" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The base URL of the Keycloak authorization server. This is Keycloak-specific. It is recommended to use 'provider-url' instead.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "alternatives" : ["provider-url"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "authentication-request-format" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The format to use for specifying query parameters in authentication request.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : "oauth2",
                  "allowed" : [
                      "oauth2",
                      "request",
                      "request_uri"
                  ],
                  "stability" : "preview"
              },
              "autodetect-bearer-only" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Whether to auto-detect SOAP or REST clients based on headers like 'X-Requested-With', 'SOAPAction' or 'Accept'. If set to 'true', the subsystem sends an HTTP 401 status code to unauthenticated SOAP or REST clients instead of redirecting them to the OpenID provider login page. Set the value to 'true' if your application serves both applications and web services.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "bearer-only" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Enable Bearer-Token only authentication. Set this to 'true' if your application serves only web services and does not authenticate users.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "client-id" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The unique identifier for a client application registered in the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "alternatives" : ["resource"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-key-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The password for the client key. This is required if 'client-keystore' has been specified.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-keystore" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The path to the client keystore to use when communicating with the OpenID provider over HTTPS. This is optional.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "client-keystore-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The password for the client keystore. This is required if 'client-keystore' has been specified.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "confidential-port" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "The confidential port used by the OpenID provider when communicating securely over SSL/TLS.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : 8443,
                  "stability" : "default"
              },
              "connection-pool-size" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "The connection pool size to use when communicating with the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : 0,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "connection-timeout-millis" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "LONG"
                  },
                  "description" : "The timeout for establishing a connection with the remote host in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "connection-ttl-millis" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "LONG"
                  },
                  "description" : "The amount of time in milliseconds for the connection to be kept alive. A value less than or equal to zero is interpreted as an infinite value.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "cors-allowed-headers" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "cors-allowed-methods" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Allow-Methods' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "cors-exposed-headers" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Expose-Headers' header. This should be a comma-separated string. This is optional. If not set, this header is not returned in CORS responses.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "cors-max-age" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "If Cross-Origin Resource Sharing (CORS) is enabled, this sets the value of the 'Access-Control-Max-Age' header. If not set, this header is not returned in CORS responses.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "credential" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "OBJECT"
                  },
                  "description" : "The credential used to communicate with the OpenID Connect provider.",
                  "expressions-allowed" : false,
                  "required" : false,
                  "nillable" : true,
                  "stability" : "default",
                  "value-type" : {
                      "secret" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The client secret that was registered with the OpenID provider.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "client-keystore-file" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The path to the client keystore when the credential provider is used. This is optional.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "client-keystore-type" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The client keystore type when the credential provider is used.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "client-keystore-password" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The password for the client keystore when the credential provider is used. This is required if 'client-keystore-file' has been specified.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "client-key-password" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The password for the client key when the credential provider is used. This is required if 'client-keystore-file' has been specified.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "token-timeout" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "INT"
                          },
                          "description" : "The amount of time after which the token expires and can no longer be used to authenticate requests.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min" : 1,
                          "max" : 2147483647,
                          "stability" : "default"
                      },
                      "client-key-alias" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The client key alias when the credential provider is used.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      },
                      "algorithm" : {
                          "type" : {
                              "TYPE_MODEL_VALUE" : "STRING"
                          },
                          "description" : "The credential signature algorithm used by the OpenID provider.",
                          "expressions-allowed" : true,
                          "required" : false,
                          "nillable" : true,
                          "min-length" : 1,
                          "max-length" : 2147483647,
                          "stability" : "default"
                      }
                  }
              },
              "disable-trust-manager" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Whether or not to make use of a trust manager when communicating with the OpenID provider over HTTPS. This is optional. This should be set to 'true' only during development and never in production as it disables verification of SSL certificates.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "enable-basic-auth" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Enable Basic authentication. This is not supported in the current release.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "enable-cors" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Enable the Keycloak Cross-Origin Resource Sharing (CORS) support. This is optional. This is Keycloak-specific.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "expose-token" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', an authenticated browser client can obtain the signed access token (through a Javascript HTTP invocation) via the URL 'root/k_query_bearer_token'. This is optional.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "ignore-oauth-query-parameter" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "Disable query parameter parsing for the 'access_token'. Users will not be able to authenticate if they only pass in an 'access_token'.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "min-time-between-jwks-requests" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "If the subsystem recognizes a token signed by an unknown public key, it will try to download a new public key from the server. The subsystem won't try to download a public key if it already tried last in less than 'min-time-between-jwks-requests' seconds.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "principal-attribute" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "Indicates which value from the ID token to use as the principal for the identity. The principal defaults to the value of the 'sub' if the token attribute is null.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "provider" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The OpenID Connect provider to use for authentication.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "provider-url" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The OpenID provider URL.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "alternatives" : ["auth-server-url"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "proxy-url" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The URL for the HTTP proxy if one is used.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "public-client" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', no client credentials are sent when communicating with the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "public-key-cache-ttl" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "The maximum interval between two requests to retrieve new public keys in seconds. New public keys are downloaded when the subsystem recognizes a token signed by an unknown public key. Even if the token's key is already known, new public keys are downloaded periodically as per the interval set here at least once.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "realm" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The Keycloak realm to use for authentication.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "realm-public-key" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The public key of the OpenID provider in PEM format. This is optional. It is not recommended to set it. If the public key is not set, the subsystem downloads the public key from the OpenID provider when needed. If the public key is set, the subsystem never downloads new keys from the OpenID provider, breaking the subsystem when the OpenID provider rotates its keys.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "redirect-rewrite-rule" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "OBJECT"
                  },
                  "description" : "The rewrite rule for the redirect URI. The rewrite rule is an object notation, where the key is a regular expression with which the redirect URI is matched and the value is the replacement String.",
                  "expressions-allowed" : false,
                  "required" : false,
                  "nillable" : true,
                  "stability" : "default",
                  "value-type" : {"replacement" : {
                      "type" : {
                          "TYPE_MODEL_VALUE" : "STRING"
                      },
                      "description" : "The replacement String in the rewrite rule for the redirect URI.",
                      "expressions-allowed" : true,
                      "required" : false,
                      "nillable" : true,
                      "min-length" : 1,
                      "max-length" : 2147483647,
                      "stability" : "default"
                  }}
              },
              "register-node-at-startup" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', the subsystem sends a registration request to the OpenID provider. This attribute is useful only when your application is clustered.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "register-node-period" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "If 'register-node-at-startup' is set to 'true', this specifies the frequency (in seconds) at which the node should be re-registered.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "request-object-encryption-alg-value" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The encryption algorithm used to encrypt the request object.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "requires" : ["request-object-encryption-enc-value"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-encryption-enc-value" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The content encryption algorithm used to encrypt the request object.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "requires" : ["request-object-encryption-alg-value"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-algorithm" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The algorithm used to sign the request object. The default value fot this attribute is \"none\".",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : "none",
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-key-alias" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The key alias when a key pair is used to sign request objects.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-key-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The key password when a key pair is used to sign request objects.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-keystore-file" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The path to the keystore to use when signing a request object. This is required if an asymmetric signing algorithm for request object is indicated.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-keystore-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The keystore password when a key pair is used to sign request objects.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "request-object-signing-keystore-type" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The keystore type used to specify the client key pair used to sign request objects.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "resource" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The unique, legacy identifier for a client application registered in the OpenID provider. It is recommended to use the 'client-id'.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "alternatives" : ["client-id"],
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "scope" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "A space separated list of scope values that should be used in the OIDC authentication request. Scopes can be used to request that specific sets of information be made available as Claim Values.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "preview"
              },
              "socket-timeout-millis" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "LONG"
                  },
                  "description" : "The timeout for the socket waiting for data after establishing the connection in milliseconds. A timeout value of zero is interpreted as an infinite timeout, and a negative value is interpreted as undefined.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "ssl-required" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "Whether the communication with the OpenID provider should be over HTTPS. Valid values are: 'all' - to always require HTTPS, 'external' - to only require HTTPS for external requests, 'none' - if HTTPS is not required. This should be set to 'all' in production environments.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : "external",
                  "allowed" : [
                      "ALL",
                      "EXTERNAL",
                      "NONE"
                  ],
                  "stability" : "default"
              },
              "token-minimum-time-to-live" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "INT"
                  },
                  "description" : "The subsystem will refresh the token if it will expire within the duration specified in 'token-minimum-time-to-live' seconds. This value should never exceed the access token lifespan. If the value is set to 0 seconds, the subsystem will refresh the token only if the token has expired.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min" : -1,
                  "max" : 2147483647,
                  "stability" : "default"
              },
              "token-signature-algorithm" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The token signature algorithm used by the OpenID provider.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : "RS256",
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "token-store" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "Defines whether to store account information in an HTTP session or in a cookie.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "truststore" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The path to the truststore to use when communicating with Keycloak over HTTPS. Prefix the path with 'classpath:' to obtain the truststore from the deployment's classpath.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "truststore-password" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "STRING"
                  },
                  "description" : "The password for the truststore.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "min-length" : 1,
                  "max-length" : 2147483647,
                  "stability" : "default"
              },
              "turn-off-change-session-id-on-login" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "The Session ID is changed by default on a successful login. Set this to 'true' if you want to turn this off.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "use-resource-role-mappings" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', the subsystem will look inside the token for application-level role mappings for a user. If set to 'false', the subsystem will look at the realm-level for user-role mappings. This is optional.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              },
              "verify-token-audience" : {
                  "type" : {
                      "TYPE_MODEL_VALUE" : "BOOLEAN"
                  },
                  "description" : "If set to 'true', then during bearer-only authentication, the subsystem verifies if the token contains the client name defined as an audience. It is recommended to set the value to 'true' for improved security.",
                  "expressions-allowed" : true,
                  "required" : false,
                  "nillable" : true,
                  "default" : false,
                  "stability" : "default"
              }
          },
          "reply-properties" : {},
          "stability" : "default",
          "read-only" : false,
          "restart-required" : "resource-services",
          "runtime-only" : false
      }

- remove - Remove a deployment secured by an OpenID Connect provider.

  Raw DMR model |
      {
          "operation-name" : "remove",
          "description" : "Remove a deployment secured by an OpenID Connect provider.",
          "request-properties" : {},
          "reply-properties" : {},
          "stability" : "default",
          "read-only" : false,
          "restart-required" : "resource-services",
          "runtime-only" : false
      }

## Galleon Features

Galleon features are to be used when creating Galleon feature-packs.

- subsystem.elytron-oidc-client.secure-deployment

      <feature spec="subsystem.elytron-oidc-client.secure-deployment">
        <param name="secure-deployment" value="{resource name}"/>
        <param name="adapter-state-cookie-path" value="{value}"/>
        <param name="allow-any-hostname" value="{value}"/>
        <param name="always-refresh-token" value="{value}"/>
        <param name="auth-server-url" value="{value}"/>
        <param name="authentication-request-format" value="{value}"/>
        <param name="autodetect-bearer-only" value="{value}"/>
        <param name="bearer-only" value="{value}"/>
        <param name="client-id" value="{value}"/>
        <param name="client-key-password" value="{value}"/>
        <param name="client-keystore" value="{value}"/>
        <param name="client-keystore-password" value="{value}"/>
        <param name="confidential-port" value="{value}"/>
        <param name="connection-pool-size" value="{value}"/>
        <param name="connection-timeout-millis" value="{value}"/>
        <param name="connection-ttl-millis" value="{value}"/>
        <param name="cors-allowed-headers" value="{value}"/>
        <param name="cors-allowed-methods" value="{value}"/>
        <param name="cors-exposed-headers" value="{value}"/>
        <param name="cors-max-age" value="{value}"/>
        <param name="credential" value="{value}"/>
        <param name="disable-trust-manager" value="{value}"/>
        <param name="enable-basic-auth" value="{value}"/>
        <param name="enable-cors" value="{value}"/>
        <param name="expose-token" value="{value}"/>
        <param name="ignore-oauth-query-parameter" value="{value}"/>
        <param name="min-time-between-jwks-requests" value="{value}"/>
        <param name="principal-attribute" value="{value}"/>
        <param name="provider" value="{value}"/>
        <param name="provider-url" value="{value}"/>
        <param name="proxy-url" value="{value}"/>
        <param name="public-client" value="{value}"/>
        <param name="public-key-cache-ttl" value="{value}"/>
        <param name="realm" value="{value}"/>
        <param name="realm-public-key" value="{value}"/>
        <param name="redirect-rewrite-rule" value="{value}"/>
        <param name="register-node-at-startup" value="{value}"/>
        <param name="register-node-period" value="{value}"/>
        <param name="request-object-encryption-alg-value" value="{value}"/>
        <param name="request-object-encryption-enc-value" value="{value}"/>
        <param name="request-object-signing-algorithm" value="{value}"/>
        <param name="request-object-signing-key-alias" value="{value}"/>
        <param name="request-object-signing-key-password" value="{value}"/>
        <param name="request-object-signing-keystore-file" value="{value}"/>
        <param name="request-object-signing-keystore-password" value="{value}"/>
        <param name="request-object-signing-keystore-type" value="{value}"/>
        <param name="resource" value="{value}"/>
        <param name="scope" value="{value}"/>
        <param name="socket-timeout-millis" value="{value}"/>
        <param name="ssl-required" value="{value}"/>
        <param name="token-minimum-time-to-live" value="{value}"/>
        <param name="token-signature-algorithm" value="{value}"/>
        <param name="token-store" value="{value}"/>
        <param name="truststore" value="{value}"/>
        <param name="truststore-password" value="{value}"/>
        <param name="turn-off-change-session-id-on-login" value="{value}"/>
        <param name="use-resource-role-mappings" value="{value}"/>
        <param name="verify-token-audience" value="{value}"/>
      <feature/>