Chapter 23. KafkaAuthorizationKeycloak schema reference

type

Must be keycloak.

string

clientId

OAuth Client ID which the Kafka client can use to authenticate against the OAuth server and use the token endpoint URI.

string

tokenEndpointUri

Authorization server token endpoint URI.

string

tlsTrustedCertificates

Trusted certificates for TLS connection to the OAuth server.

CertSecretSource array

disableTlsHostnameVerification

Enable or disable TLS hostname verification. Default value is false.

boolean

delegateToKafkaAcls

Whether authorization decision should be delegated to the 'Simple' authorizer if DENIED by Red Hat Single Sign-On Authorization Services policies. Default value is false.

boolean

grantsRefreshPeriodSeconds

The time between two consecutive grants refresh runs in seconds. The default value is 60.

integer

grantsRefreshPoolSize

The number of threads to use to refresh grants for active sessions. The more threads, the more parallelism, so the sooner the job completes. However, using more threads places a heavier load on the authorization server. The default value is 5.

integer

grantsGcPeriodSeconds

The time, in seconds, between consecutive runs of a job that cleans stale grants from the cache. The default value is 300.

integer

grantsAlwaysLatest

Controls whether the latest grants are fetched for a new session. When enabled, grants are retrieved from Red Hat Single Sign-On and cached for the user. The default value is false.

boolean

superUsers

List of super users. Should contain list of user principals which should get unlimited access rights.

string array

connectTimeoutSeconds

The connect timeout in seconds when connecting to authorization server. If not set, the effective connect timeout is 60 seconds.

integer

readTimeoutSeconds

The read timeout in seconds when connecting to authorization server. If not set, the effective read timeout is 60 seconds.

integer

httpRetries

The maximum number of retries to attempt if an initial HTTP request fails. If not set, the default is to not attempt any retries.

integer

enableMetrics

Enable or disable OAuth metrics. The default value is false.

boolean

includeAcceptHeader

Whether the Accept header should be set in requests to the authorization servers. The default value is true.

boolean

grantsMaxIdleTimeSeconds

The time, in seconds, after which an idle grant can be evicted from the cache. The default value is 300.

integer