Chapter 22. All provider configuration

spi-authentication-sessions--infinispan--auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

300 (default) or any int

spi-authentication-sessions--remote--auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

300 (default) or any int

spi-authentication-sessions--remote--max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-authentication-sessions--remote--retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests

If concurrent logins are allowed by the brute force protection.

true, false (default)

spi-cache-embedded--default--action-tokens-owners

Sets the number of owners for the actionTokens distributed cache.

any Integer

spi-cache-embedded--default--authentication-sessions-owners

Sets the number of owners for the authenticationSessions distributed cache.

any Integer

spi-cache-embedded--default--authorization-max-count

The maximum number of entries that can be stored in-memory by the authorization cache.

any Integer

spi-cache-embedded--default--authorization-revisions-max-count

The maximum number of entries that can be stored in-memory by the authorizationRevisions cache.

any Integer

spi-cache-embedded--default--client-sessions-max-count

The maximum number of entries that can be stored in-memory by the clientSessions cache.

any Integer

spi-cache-embedded--default--client-sessions-owners

Sets the number of owners for the clientSessions distributed cache.

any Integer

spi-cache-embedded--default--config-file

Defines the file from which cache configuration should be loaded from.

any String

spi-cache-embedded--default--crl-max-count

The maximum number of entries that can be stored in-memory by the crl cache.

any Integer

spi-cache-embedded--default--keys-max-count

The maximum number of entries that can be stored in-memory by the keys cache.

any Integer

spi-cache-embedded--default--login-failures-owners

Sets the number of owners for the loginFailures distributed cache.

any Integer

spi-cache-embedded--default--machine-name

The name of the physical machine where this instance runs.

any String

spi-cache-embedded--default--metrics-histograms-enabled

Enable histograms for metrics for the embedded caches.

true, false (default)

spi-cache-embedded--default--network-bind-address

IP address used by clustering transport.

any String

spi-cache-embedded--default--network-bind-port

The Port the clustering transport will bind to.

any Integer

spi-cache-embedded--default--network-external-address

IP address that other instances in the cluster should use to contact this node.

any String

spi-cache-embedded--default--network-external-port

Port that other instances in the cluster should use to contact this node.

any Integer

spi-cache-embedded--default--node-name

Sets the name of the current node.

any String

spi-cache-embedded--default--offline-client-sessions-max-count

The maximum number of entries that can be stored in-memory by the offlineClientSessions cache.

any Integer

spi-cache-embedded--default--offline-sessions-max-count

The maximum number of entries that can be stored in-memory by the offlineSessions cache.

any Integer

spi-cache-embedded--default--rack-name

The name of the rack where this instance runs.

any String

spi-cache-embedded--default--realm-revisions-max-count

The maximum number of entries that can be stored in-memory by the realmRevisions cache.

any Integer

spi-cache-embedded--default--realms-max-count

The maximum number of entries that can be stored in-memory by the realms cache.

any Integer

spi-cache-embedded--default--sessions-max-count

The maximum number of entries that can be stored in-memory by the sessions cache.

any Integer

spi-cache-embedded--default--sessions-owners

Sets the number of owners for the sessions distributed cache.

any Integer

spi-cache-embedded--default--site-name

The name of the site (availability zone) where this instance runs.

any String

spi-cache-embedded--default--user-revisions-max-count

The maximum number of entries that can be stored in-memory by the userRevisions cache.

any Integer

spi-cache-embedded--default--users-max-count

The maximum number of entries that can be stored in-memory by the users cache.

any Integer

spi-cache-remote--default--auth-realm

Specifies the Infinispan server realm to be used for authentication.

default (default) or any String

spi-cache-remote--default--backup-sites

Configures a list of backup sites names to where the external Infinispan cluster backups the Keycloak data.

any List

spi-cache-remote--default--client-intelligence

Specifies the level of intelligence the Hot Rod client should have.

BASIC, TOPOLOGY_AWARE, HASH_DISTRIBUTION_AWARE (default)

spi-cache-remote--default--connection-pool-exhausted-action

Specifies what happens when asking for a connection from a server’s pool, and that pool is exhausted.

EXCEPTION, WAIT, CREATE_NEW (default)

spi-cache-remote--default--connection-pool-max-active

Sets the maximum number of connections per Infinispan server instance.

16 (default) or any Integer

spi-cache-remote--default--hostname

The hostname of the external Infinispan cluster.

any String

spi-cache-remote--default--password

The password for the authentication to the external Infinispan cluster.

any String

spi-cache-remote--default--port

The port of the external Infinispan cluster.

11222 (default) or any Integer

spi-cache-remote--default--properties-file

Path to the properties file with the Hot Rod client configuration.

any File

spi-cache-remote--default--sasl-mechanism

Selects the SASL mechanism to use for the connection to the Infinispan server.

SCRAM-SHA-512 (default) or any String

spi-cache-remote--default--tls-enabled

Enable TLS support to communicate with a secured remote Infinispan server.

true (default), false

spi-cache-remote--default--tls-sni-hostname

Specifies the TLS SNI hostname for the connection to the Infinispan server.

any String

spi-cache-remote--default--username

The username for the authentication to the external Infinispan cluster.

any String

spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri

The HTTP(S) URI of the authentication channel.

any string

spi-connections-http-client--default--client-key-password

The key password.

-1 (default) or any string

spi-connections-http-client--default--client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

any string

spi-connections-http-client--default--client-keystore-password

The key store password.

any string

spi-connections-http-client--default--connection-pool-size

Assigns maximum total connection value.

any int

spi-connections-http-client--default--connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

-1 (default) or any long

spi-connections-http-client--default--disable-cookies

Disables state (cookie) management.

true (default), false

spi-connections-http-client--default--disable-trust-manager

Disable trust management and hostname verification.

true, false (default)

spi-connections-http-client--default--establish-connection-timeout-millis

When trying to make an initial socket connection, what is the timeout?

-1 (default) or any long

spi-connections-http-client--default--max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

900000 (default) or any long

spi-connections-http-client--default--max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

10000000 (default) or any long

spi-connections-http-client--default--max-pooled-per-route

Assigns maximum connection per route value.

64 (default) or any int

spi-connections-http-client--default--proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

any string

spi-connections-http-client--default--reuse-connections

If connections should be reused.

true (default), false

spi-connections-http-client--default--socket-timeout-millis

Socket inactivity timeout.

5000 (default) or any long

spi-connections-http-client--opentelemetry--client-key-password

The key password.

-1 (default) or any string

spi-connections-http-client--opentelemetry--client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

any string

spi-connections-http-client--opentelemetry--client-keystore-password

The key store password.

any string

spi-connections-http-client--opentelemetry--connection-pool-size

Assigns maximum total connection value.

any int

spi-connections-http-client--opentelemetry--connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

-1 (default) or any long

spi-connections-http-client--opentelemetry--disable-cookies

Disables state (cookie) management.

true (default), false

spi-connections-http-client--opentelemetry--disable-trust-manager

Disable trust management and hostname verification.

true, false (default)

spi-connections-http-client--opentelemetry--establish-connection-timeout-millis

When trying to make an initial socket connection, what is the timeout?

-1 (default) or any long

spi-connections-http-client--opentelemetry--max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

900000 (default) or any long

spi-connections-http-client--opentelemetry--max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

10000000 (default) or any long

spi-connections-http-client--opentelemetry--max-pooled-per-route

Assigns maximum connection per route value.

64 (default) or any int

spi-connections-http-client--opentelemetry--proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

any string

spi-connections-http-client--opentelemetry--reuse-connections

If connections should be reused.

true (default), false

spi-connections-http-client--opentelemetry--socket-timeout-millis

Socket inactivity timeout.

5000 (default) or any long

spi-connections-jpa--quarkus--initialize-empty

Initialize database if empty.

true (default), false

spi-connections-jpa--quarkus--migration-export

Path for where to write manual database initialization/migration file.

any string

spi-connections-jpa--quarkus--migration-strategy

Strategy to use to migrate database.

update (default), manual, validate

spi-credential--keycloak-password--validations-counter-tags

Comma-separated list of tags to be used when publishing password validation counter metric.

realm, algorithm, hashing_strength, outcome

spi-crl-storage--infinispan--cache-time

Interval in seconds that the CRL is cached.

-1 (default) or any int

spi-crl-storage--infinispan--min-time-between-requests

Minimum interval in seconds between two requests to retrieve the CRL.

10 (default) or any int

spi-datastore--legacy--allow-migrate-existing-database-to-snapshot

By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.

true, false (default)

spi-dblock--jpa--lock-wait-timeout

The maximum time to wait when waiting to release a database lock.

any int

spi-device-representation--device-representation--cache-size

Sets the maximum number of parsed user-agent values in the local cache.

2048 (default) or any Integer

spi-events-listener--email--exclude-events

A comma-separated list of events that should not be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, validate_access_token, validate_access_token_error, verify_email, verify_email_error, verify_profile, verify_profile_error

spi-events-listener--email--include-events

A comma-separated list of events that should be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, validate_access_token, validate_access_token_error, verify_email, verify_email_error, verify_profile, verify_profile_error

spi-events-listener--jboss-logging--error-level

The log level for error messages.

debug, error, fatal, info, trace, warn (default)

spi-events-listener--jboss-logging--include-representation

When "true" the "representation" field with the JSON admin object is also added to the message.

true, false (default)

spi-events-listener--jboss-logging--quotes

The quotes to use for values, it should be one character like " or '.

" (default) or any string

spi-events-listener--jboss-logging--sanitize

If true the log messages are sanitized to avoid line breaks.

true (default), false

spi-events-listener--jboss-logging--success-level

The log level for success messages.

debug (default), error, fatal, info, trace, warn

spi-export--dir--dir

Directory to export to

any string

spi-export--dir--realm-name

Realm to export

any string

spi-export--dir--users-export-strategy

Users export strategy

DIFFERENT_FILES (default) or any string

spi-export--dir--users-per-file

Users per exported file

50 (default) or any int

spi-export--single-file--file

File to export to

any string

spi-export--single-file--realm-name

Realm to export

any string

spi-group--jpa--escape-slashes-in-group-path

If true slashes / in group names are escaped with the character ~ when converted to paths.

true, false (default)

spi-group--jpa--searchable-attributes

The list of attributes separated by comma that are allowed in client attribute searches.

any string

spi-import--dir--dir

Directory to import from

any string

spi-import--dir--realm-name

Realm to export

any string

spi-import--dir--strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

any string

spi-import--single-file--file

File to import from

any string

spi-import--single-file--realm-name

Realm to export

any string

spi-import--single-file--strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

any string

spi-jgroups-mtls--default--enabled

Encrypts the network communication between Keycloak servers.

true (default), false

spi-jgroups-mtls--default--keystore-file

The Keystore file path.

any String

spi-jgroups-mtls--default--keystore-password

The password to access the Keystore.

any Password

spi-jgroups-mtls--default--rotation

Rotation period in days of automatic JGroups MTLS certificates.

30 (default) or any Integer

spi-jgroups-mtls--default--truststore-file

The Truststore file path.

any String

spi-jgroups-mtls--default--truststore-password

The password to access the Truststore.

any Password

spi-load-balancer-check--remote--poll-interval

The Remote caches poll interval, in milliseconds, for connection availability

5000 (default) or any int

spi-login-protocol--openid-connect--add-req-params-fail-fast

Whether the fail-fast strategy should be enforced in case if the limit for some standard OIDC parameter or additional OIDC parameter is not met for the parameters sent to the OIDC authentication request.

true, false (default)

spi-login-protocol--openid-connect--add-req-params-max-number

Maximum number of additional request parameters sent to the OIDC authentication request.

5 (default) or any int

spi-login-protocol--openid-connect--add-req-params-max-overall-size

Maximum size of all additional request parameters values together.

2147483647 (default) or any int

spi-login-protocol--openid-connect--add-req-params-max-size

Maximum size of single additional request parameter value See add-req-params-max-number for more details about additional request parameters

2000 (default) or any int

spi-login-protocol--openid-connect--req-params-default-max-size

Maximum default length of the standard OIDC parameter sent to the OIDC authentication request.

4000 (default) or any int

spi-login-protocol--openid-connect--req-params-max-size--login_hint

Maximum length of the standard OIDC authentication request parameter overriden for the specified parameter.

any int

spi-login-failure--remote--max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-login-failure--remote--retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-mapped-diagnostic-context--default--mdc-keys

Comma-separated list of MDC keys to add to the Mapped Diagnostic Context.

realmName, clientId, userId, ipAddress, org, sessionId, authenticationSessionId, authenticationTabId

spi-password-hashing--argon2--cpu-cores

Maximum parallel CPU cores to use for hashing

any int

spi-password-hashing--argon2--hash-length

Hash length

32 (default) or any int

spi-password-hashing--argon2--iterations

Iterations

5 (default) or any int

spi-password-hashing--argon2--memory

Memory size (KB)

7168 (default) or any int

spi-password-hashing--argon2--parallelism

Parallelism

1 (default) or any int

spi-password-hashing--argon2--type

Type

id (default), d, i

spi-password-hashing--argon2--version

Version

1.3 (default), 1.0

spi-public-key-storage--infinispan--max-cache-time

Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.

86400 (default) or any int

spi-public-key-storage--infinispan--min-time-between-requests

Minimum interval in seconds between two requests to retrieve the new public keys.

10 (default) or any int

spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold

When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will recommend him to setup new set of recovery codes.

4 (default) or any Integer

spi-required-action--CONFIGURE_TOTP--add-recovery-codes

If this option is enabled, the user will be required to configure recovery codes following the OTP configuration.

true, false (default)

spi-required-action--CONFIGURE_TOTP--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--TERMS_AND_CONDITIONS--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--UPDATE_EMAIL--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--UPDATE_EMAIL--verify-email

If enabled, the user will be forced to verify the email regardless if email verification is enabled at the realm level or not.

true, false (default)

spi-required-action--UPDATE_PASSWORD--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--UPDATE_PROFILE--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--VERIFY_EMAIL--email-resend-cooldown-seconds

Minimum delay in seconds before another email verification email can be sent.

30 (default) or any String

spi-required-action--VERIFY_EMAIL--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--VERIFY_PROFILE--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--delete_credential--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--idp_link--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--update_user_locale--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--webauthn-register--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-required-action--webauthn-register-passwordless--max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-resource-encoding--gzip--excluded-content-types

A space separated list of content-types to exclude from encoding.

image/png image/jpeg (default) or any string

spi-security-profile--default--name

Name for the security configuration file to use.

any string

spi-single-use-object--infinispan--persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true (default), false

spi-single-use-object--remote--persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true (default), false

spi-sticky-session-encoder--infinispan--should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true (default), false

spi-sticky-session-encoder--remote--should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true (default), false

spi-truststore--file--file

DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.

any string

spi-truststore--file--hostname-verification-policy

DEPRECATED: The hostname verification policy.

ANY, WILDCARD, STRICT, DEFAULT (default)

spi-truststore--file--password

DEPRECATED: The trust store password.

any string

spi-truststore--file--type

DEPRECATED: Type of the truststore.

any string

spi-user-profile--declarative-user-profile--admin-read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so administrators can’t change them.

any MultivaluedString

spi-user-profile--declarative-user-profile--max-email-local-part-length

To set user profile max email local part length

any String

spi-user-profile--declarative-user-profile--read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so users can’t change them.

any MultivaluedString

spi-user-sessions--infinispan--max-batch-size

Maximum size of a batch (only applicable to persistent sessions

4 (default) or any int

spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override

Override how long offline client sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)

any int

spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override

Override how long offline user sessions should be kept in memory in seconds (deprecated, to be removed in Keycloak 27)

any int

spi-user-sessions--infinispan--use-batches

Enable or disable batch writes to the database.

true, false (default)

spi-user-sessions--infinispan--use-caches

Enable or disable caches.

true, false

spi-user-sessions--remote--batch-size

Batch size when streaming session from the remote cache

1024 (default) or any int

spi-user-sessions--remote--max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-user-sessions--remote--retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-well-known--oauth-authorization-server--include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true (default), false

spi-well-known--oauth-authorization-server--openid-configuration-override

The file path from where the metadata should be loaded from.

any string

spi-well-known--openid-configuration--include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true (default), false

spi-well-known--openid-configuration--openid-configuration-override

The file path from where the metadata should be loaded from.

any string