keycloak-provisioner

realms:
  - realm: "my-realm"
    displayName: "My Realm"
    enabled: true
    sslRequired: "external"
    loginTheme: "keycloak"
    registrationAllowed: false
    resetPasswordAllowed: true
    loginWithEmailAllowed: true

    # Brute force detection: lock an account temporarily after repeated failed
    # logins. The thresholds keep Keycloak's current values.
    bruteForceProtected: true

    # Override the global strategy for this realm only.
    # strategy: "update"

    # Enable Keycloak Organizations for this realm (Keycloak 26+).
    # Omit to leave the realm's current setting untouched. Required before
    # the organizations block below can be used.
    # organizationsEnabled: true

    # Realm attributes. Keys and values support ${VAR} expansion.
    # These are MERGED over the realm's current attributes, so keys managed
    # outside this config are preserved. Omit the block to leave them alone.
    # attributes:
    #   frontendUrl: "https://id.example.com"

    # Step-up authentication: map ACR values to Levels of Authentication.
    # Written to the realm's acr.loa.map attribute; wins over an acr.loa.map
    # entry set manually under attributes. Levels must not be negative.
    # acrLoaMap:
    #   silver: 1
    #   gold: 2

    # Authentication flows are created before clients, so a client below can
    # bind to a flow defined here. Flows are CREATE-ONLY: an existing alias is
    # left untouched whatever the strategy. To change a flow, delete it in
    # Keycloak or use a new alias. Declaring a built-in flow (browser, direct
    # grant, ...) is rejected — use copyFrom to derive your own instead.