Chapter 22. All provider configuration

spi-authentication-sessions-infinispan-auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

300 (default) or any int

spi-authentication-sessions-remote-auth-sessions-limit

The maximum number of concurrent authentication sessions per RootAuthenticationSession.

300 (default) or any int

spi-authentication-sessions-remote-max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-authentication-sessions-remote-retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests

If concurrent logins are allowed by the brute force protection.

true, false (default)

spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri

The HTTP(S) URI of the authentication channel.

any string

spi-connections-http-client-default-client-key-password

The key password.

-1 (default) or any string

spi-connections-http-client-default-client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

any string

spi-connections-http-client-default-client-keystore-password

The key store password.

any string

spi-connections-http-client-default-connection-pool-size

Assigns maximum total connection value.

any int

spi-connections-http-client-default-connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

-1 (default) or any long

spi-connections-http-client-default-disable-cookies

Disables state (cookie) management.

true (default), false

spi-connections-http-client-default-disable-trust-manager

Disable trust management and hostname verification.

true, false (default)

spi-connections-http-client-default-establish-connection-timeout-millis

When trying to make an initial socket connection, what is the timeout?

-1 (default) or any long

spi-connections-http-client-default-max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

900000 (default) or any long

spi-connections-http-client-default-max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

10000000 (default) or any long

spi-connections-http-client-default-max-pooled-per-route

Assigns maximum connection per route value.

64 (default) or any int

spi-connections-http-client-default-proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

any string

spi-connections-http-client-default-reuse-connections

If connections should be reused.

true (default), false

spi-connections-http-client-default-socket-timeout-millis

Socket inactivity timeout.

5000 (default) or any long

spi-connections-http-client-opentelemetry-client-key-password

The key password.

-1 (default) or any string

spi-connections-http-client-opentelemetry-client-keystore

The file path of the key store from where the key material is going to be read from to set-up TLS connections.

any string

spi-connections-http-client-opentelemetry-client-keystore-password

The key store password.

any string

spi-connections-http-client-opentelemetry-connection-pool-size

Assigns maximum total connection value.

any int

spi-connections-http-client-opentelemetry-connection-ttl-millis

Sets maximum time, in milliseconds, to live for persistent connections.

-1 (default) or any long

spi-connections-http-client-opentelemetry-disable-cookies

Disables state (cookie) management.

true (default), false

spi-connections-http-client-opentelemetry-disable-trust-manager

Disable trust management and hostname verification.

true, false (default)

spi-connections-http-client-opentelemetry-establish-connection-timeout-millis

When trying to make an initial socket connection, what is the timeout?

-1 (default) or any long

spi-connections-http-client-opentelemetry-max-connection-idle-time-millis

Sets the time, in milliseconds, for evicting idle connections from the pool.

900000 (default) or any long

spi-connections-http-client-opentelemetry-max-consumed-response-size

Maximum size of a response consumed by the client (to prevent denial of service)

10000000 (default) or any long

spi-connections-http-client-opentelemetry-max-pooled-per-route

Assigns maximum connection per route value.

64 (default) or any int

spi-connections-http-client-opentelemetry-proxy-mappings

Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.

any string

spi-connections-http-client-opentelemetry-reuse-connections

If connections should be reused.

true (default), false

spi-connections-http-client-opentelemetry-socket-timeout-millis

Socket inactivity timeout.

5000 (default) or any long

spi-connections-infinispan-quarkus-site-name

Site name for multi-site deployments

any string

spi-connections-jpa-quarkus-initialize-empty

Initialize database if empty.

true (default), false

spi-connections-jpa-quarkus-migration-export

Path for where to write manual database initialization/migration file.

any string

spi-connections-jpa-quarkus-migration-strategy

Strategy to use to migrate database.

update (default), manual, validate

spi-credential-keycloak-password-validations-counter-tags

Comma-separated list of tags to be used when publishing password validation counter metric.

realm, algorithm, hashing_strength, outcome

spi-crl-storage-infinispan-cache-time

Interval in seconds that the CRL is cached.

-1 (default) or any int

spi-crl-storage-infinispan-min-time-between-requests

Minimum interval in seconds between two requests to retrieve the CRL.

10 (default) or any int

spi-datastore-legacy-allow-migrate-existing-database-to-snapshot

By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.

true, false (default)

spi-dblock-jpa-lock-wait-timeout

The maximum time to wait when waiting to release a database lock.

any int

spi-events-listener-email-exclude-events

A comma-separated list of events that should not be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, validate_access_token, validate_access_token_error, verify_email, verify_email_error, verify_profile, verify_profile_error

spi-events-listener-email-include-events

A comma-separated list of events that should be sent via email to the user’s account.

authreqid_to_token, authreqid_to_token_error, client_delete, client_delete_error, client_info, client_info_error, client_initiated_account_linking, client_initiated_account_linking_error, client_login, client_login_error, client_register, client_register_error, client_update, client_update_error, code_to_token, code_to_token_error, custom_required_action, custom_required_action_error, delete_account, delete_account_error, execute_action_token, execute_action_token_error, execute_actions, execute_actions_error, federated_identity_link, federated_identity_link_error, federated_identity_override_link, federated_identity_override_link_error, grant_consent, grant_consent_error, identity_provider_first_login, identity_provider_first_login_error, identity_provider_link_account, identity_provider_link_account_error, identity_provider_login, identity_provider_login_error, identity_provider_post_login, identity_provider_post_login_error, identity_provider_response, identity_provider_response_error, identity_provider_retrieve_token, identity_provider_retrieve_token_error, impersonate, impersonate_error, introspect_token, introspect_token_error, invalid_signature, invalid_signature_error, invite_org, invite_org_error, login, login_error, logout, logout_error, oauth2_device_auth, oauth2_device_auth_error, oauth2_device_code_to_token, oauth2_device_code_to_token_error, oauth2_device_verify_user_code, oauth2_device_verify_user_code_error, oauth2_extension_grant, oauth2_extension_grant_error, permission_token, permission_token_error, pushed_authorization_request, pushed_authorization_request_error, refresh_token, refresh_token_error, register, register_error, register_node, register_node_error, remove_credential, remove_credential_error, remove_federated_identity, remove_federated_identity_error, remove_totp, remove_totp_error, reset_password, reset_password_error, restart_authentication, restart_authentication_error, revoke_grant, revoke_grant_error, send_identity_provider_link, send_identity_provider_link_error, send_reset_password, send_reset_password_error, send_verify_email, send_verify_email_error, token_exchange, token_exchange_error, unregister_node, unregister_node_error, update_consent, update_consent_error, update_credential, update_credential_error, update_email, update_email_error, update_password, update_password_error, update_profile, update_profile_error, update_totp, update_totp_error, user_disabled_by_permanent_lockout, user_disabled_by_permanent_lockout_error, user_disabled_by_temporary_lockout, user_disabled_by_temporary_lockout_error, user_info_request, user_info_request_error, validate_access_token, validate_access_token_error, verify_email, verify_email_error, verify_profile, verify_profile_error

spi-events-listener-jboss-logging-error-level

The log level for error messages.

debug, error, fatal, info, trace, warn (default)

spi-events-listener-jboss-logging-include-representation

When "true" the "representation" field with the JSON admin object is also added to the message.

true, false (default)

spi-events-listener-jboss-logging-quotes

The quotes to use for values, it should be one character like " or '.

" (default) or any string

spi-events-listener-jboss-logging-sanitize

If true the log messages are sanitized to avoid line breaks.

true (default), false

spi-events-listener-jboss-logging-success-level

The log level for success messages.

debug (default), error, fatal, info, trace, warn

spi-export-dir-dir

Directory to export to

any string

spi-export-dir-realm-name

Realm to export

any string

spi-export-dir-users-export-strategy

Users export strategy

DIFFERENT_FILES (default) or any string

spi-export-dir-users-per-file

Users per exported file

50 (default) or any int

spi-export-single-file-file

File to export to

any string

spi-export-single-file-realm-name

Realm to export

any string

spi-group-jpa-escape-slashes-in-group-path

If true slashes / in group names are escaped with the character ~ when converted to paths.

true, false (default)

spi-group-jpa-searchable-attributes

The list of attributes separated by comma that are allowed in client attribute searches.

any string

spi-import-dir-dir

Directory to import from

any string

spi-import-dir-realm-name

Realm to export

any string

spi-import-dir-strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

any string

spi-import-single-file-file

File to import from

any string

spi-import-single-file-realm-name

Realm to export

any string

spi-import-single-file-strategy

Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING

any string

spi-load-balancer-check-remote-poll-interval

The Remote caches poll interval, in milliseconds, for connection availability

5000 (default) or any int

spi-login-protocol-openid-connect-add-req-params-fail-fast

Whether the fail-fast strategy should be enforced in case if the limit for some standard OIDC parameter or additional OIDC parameter is not met for the parameters sent to the OIDC authentication request.

true, false (default)

spi-login-protocol-openid-connect-add-req-params-max-number

Maximum number of additional request parameters sent to the OIDC authentication request.

5 (default) or any int

spi-login-protocol-openid-connect-add-req-params-max-overall-size

Maximum size of all additional request parameters values together.

2147483647 (default) or any int

spi-login-protocol-openid-connect-add-req-params-max-size

Maximum size of single additional request parameter value See add-req-params-max-number for more details about additional request parameters

2000 (default) or any int

spi-login-protocol-openid-connect-req-params-default-max-size

Maximum default length of the standard OIDC parameter sent to the OIDC authentication request.

4000 (default) or any int

spi-login-protocol-openid-connect-req-params-max-size—​login_hint

Maximum length of the standard OIDC authentication request parameter overriden for the specified parameter.

any int

spi-login-failure-remote-max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-login-failure-remote-retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-password-hashing-argon2-cpu-cores

Maximum parallel CPU cores to use for hashing

any int

spi-password-hashing-argon2-hash-length

Hash length

32 (default) or any int

spi-password-hashing-argon2-iterations

Iterations

5 (default) or any int

spi-password-hashing-argon2-memory

Memory size (KB)

7168 (default) or any int

spi-password-hashing-argon2-parallelism

Parallelism

1 (default) or any int

spi-password-hashing-argon2-type

Type

id (default), d, i

spi-password-hashing-argon2-version

Version

1.3 (default), 1.0

spi-public-key-storage-infinispan-max-cache-time

Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.

86400 (default) or any int

spi-public-key-storage-infinispan-min-time-between-requests

Minimum interval in seconds between two requests to retrieve the new public keys.

10 (default) or any int

spi-required-action-UPDATE_PASSWORD-max_auth_age

Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.

300 (default) or any String

spi-resource-encoding-gzip-excluded-content-types

A space separated list of content-types to exclude from encoding.

image/png image/jpeg (default) or any string

spi-security-profile-default-name

Name for the security configuration file to use.

any string

spi-single-use-object-infinispan-persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true (default), false

spi-single-use-object-remote-persist-revoked-tokens

If revoked tokens are stored persistently across restarts

true (default), false

spi-sticky-session-encoder-infinispan-should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true (default), false

spi-sticky-session-encoder-remote-should-attach-route

If the route should be attached to cookies to reflect the node that owns a particular session.

true (default), false

spi-truststore-file-file

DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.

any string

spi-truststore-file-hostname-verification-policy

DEPRECATED: The hostname verification policy.

ANY, WILDCARD, STRICT, DEFAULT (default)

spi-truststore-file-password

DEPRECATED: The trust store password.

any string

spi-truststore-file-type

DEPRECATED: Type of the truststore.

any string

spi-user-profile-declarative-user-profile-admin-read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so administrators can’t change them.

any MultivaluedString

spi-user-profile-declarative-user-profile-max-email-local-part-length

To set user profile max email local part length

any String

spi-user-profile-declarative-user-profile-read-only-attributes

Array of regular expressions to identify fields that should be treated read-only so users can’t change them.

any MultivaluedString

spi-user-sessions-infinispan-max-batch-size

Maximum size of a batch size (only applicable to persistent sessions

4 (default) or any int

spi-user-sessions-infinispan-offline-client-session-cache-entry-lifespan-override

Override how long offline client sessions should be kept in memory in seconds

any int

spi-user-sessions-infinispan-offline-session-cache-entry-lifespan-override

Override how long offline user sessions should be kept in memory in seconds

any int

spi-user-sessions-infinispan-use-caches

Enable or disable caches.

true, false

spi-user-sessions-remote-batch-size

Batch size when streaming session from the remote cache

1024 (default) or any int

spi-user-sessions-remote-max-retries

The maximum number of retries if an error occurs.

10 (default) or any int

spi-user-sessions-remote-retry-base-time

The base back-off time in milliseconds.

10 (default) or any int

spi-well-known-oauth-authorization-server-include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true (default), false

spi-well-known-oauth-authorization-server-openid-configuration-override

The file path from where the metadata should be loaded from.

any string

spi-well-known-openid-configuration-include-client-scopes

If client scopes should be used to calculate the list of supported scopes.

true (default), false

spi-well-known-openid-configuration-openid-configuration-override

The file path from where the metadata should be loaded from.

any string