Keycloak Terraform Provider

The keycloak_openid_audience_resolve_protocol_mapper resource allows you to create an "Audience Resolve" OIDC protocol mapper in Keycloak. This mapper helps automate audience management by using the presence of client roles to determine which audiences should be included in the token, rather than managing them manually.

You can attach this mapper to either a specific Client or a Client Scope.

resource "keycloak_openid_audience_resolve_protocol_mapper" "audience_mapper" {
  realm_id  = keycloak_realm.realm.id
  client_id = keycloak_openid_client.openid_client.id
  name      = "my-audience-resolve-mapper"
}

The keycloak_openid_user_attribute_protocol_mapper resource allows you to map custom user attributes defined in Keycloak to specific claims within tokens (ID tokens, access tokens, etc.).

Protocol mappers can be attached to either a specific Client or a Client Scope (which can then be shared across multiple clients).

The keycloak_openid_audience_protocol_mapper resource allows you to add audiences to the aud claim within issued tokens. You can specify an audience as either a custom string or by mapping it to the ID of an existing client.

Audience mappers can be attached to either a specific Client or a Client Scope.

resource "keycloak_openid_audience_protocol_mapper" "audience_mapper" {
  realm_id                 = keycloak_realm.realm.id
  client_id                = keycloak_openid_client.openid_client.id
  name                     = "audience-mapper"
  included_custom_audience  = "foo"
}

The keycloak_user resource allows for creating and managing Users within a Keycloak realm.

Important Note: Creating users directly via this resource is generally not recommended for production environments. Instead, users should ideally be federated from external sources using user federation providers or identity providers. This resource is primarily intended for testing purposes (e.g., acceptance tests for keycloak_group).

resource "keycloak_user" "user" {
  realm_id = keycloak_realm.realm.id
  username = "bob"
  enabled  = true

  email      = "bob@domain.com"
  first_name = "Bob"
  last_name  = "Bobson"
}

The keycloak_openid_client resource allows you to create and manage Keycloak clients that utilize the OpenID Connect (OIDC) protocol. These clients are typically applications that redirect users to Keycloak for authentication to leverage Single Sign-On (SSO) capabilities.

resource "keycloak_realm" "realm" {
  realm   = "my-realm"
  enabled = true
}

resource "keycloak_openid_client" "openid_client" {
	realm_id  = keycloak_realm.realm.id
	client_id = "test-client"

	name    = "test client"
	enabled = true

	access_type           = "CONFIDENTIAL"
	standard_flow_enabled = true
	valid_redirect_uris = [
		"http://localhost:8080/openid-callback"
	]

	login_theme = "keycloak"

	extra_config = {
		"key1" = "value1"
		"key2" = "value2"
	}
}

The keycloak_openid_user_property_protocol_mapper resource allows you to map built-in Keycloak user properties (like email) to specific claims within an OpenID Connect token.

Protocol mappers can be attached to a specific Client or to a Client Scope (which can then be shared across multiple clients). You must specify exactly one of client_id or client_scope_id.

resource "keycloak_openid_user_property_protocol_mapper" "user_property_mapper" {
  realm_id  = keycloak_realm.realm.id
  client_id = keycloak_openid_client.openid_client.id
  name      = "user-property-mapper"

  user_property = "email"
  claim_name    = "email"
}

The keycloak_saml_client resource allows you to create and manage Keycloak clients that utilize the SAML protocol. These clients are typically applications that redirect users to Keycloak for authentication to leverage Single Sign-On (SSO) capabilities.

resource "keycloak_realm" "realm" {
  realm   = "my-realm"
  enabled = true
}

resource "keycloak_saml_client" "saml_client" {
  realm_id  = keycloak_realm.realm.id
  client_id = "saml-client"
  name      = "saml-client"

  sign_documents          = false
  sign_assertions         = true
  include_authn_statement = true

  signing_certificate = file("saml-cert.pem")
  signing_private_key = file("saml-key.pem")
}

The keycloak_group resource allows you to create and manage Groups within a Keycloak realm. Groups provide a logical wrapper for users, allowing them to share attributes and roles, and enabling group membership to be mapped to claims.

Important Note: Do not use this resource to manage groups that are federated from external data sources like LDAP or Active Directory.

resource "keycloak_group" "parent_group" {
  realm_id = keycloak_realm.realm.id
  name     = "parent-group"
}

resource "keycloak_group" "child_group" {
  realm_id  = keycloak_realm.realm.id
  parent_id = keycloak_group.parent_group.id
  name      = "child-group"
}

The keycloak_openid_full_name_protocol_mapper resource allows you to map a user's first and last name to the OpenID Connect name claim in a token. You can attach these mappers to a specific client or to a client scope to share them across multiple clients.

resource "keycloak_openid_full_name_protocol_mapper" "full_name_mapper" {
  realm_id  = keycloak_realm.realm.id
  client_id = keycloak_openid_client.openid_client.id
  name      = "full-name-mapper"
}