
:guide-id: all-provider-config
:guide-title: All provider configuration
:guide-summary: Review provider configuration options.
:guide-priority: 999
:guide-tile-visible: true
:version: 26.3.3

include::../attributes.adoc[]

[[all-provider-config]]
= All provider configuration

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


== authentication-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-authentication-sessions--infinispan--auth-sessions-limit+`# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended--spi-authentication-sessions--infinispan--auth-sessions-limit,role="options-extended"]
--


*CLI:* `+--spi-authentication-sessions--infinispan--auth-sessions-limit+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__INFINISPAN__AUTH_SESSIONS_LIMIT+`
--



|[.options-default]#`+300+`# (default) or any `+int+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-authentication-sessions--remote--auth-sessions-limit+`# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended--spi-authentication-sessions--remote--auth-sessions-limit,role="options-extended"]
--


*CLI:* `+--spi-authentication-sessions--remote--auth-sessions-limit+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__AUTH_SESSIONS_LIMIT+`
--



|[.options-default]#`+300+`# (default) or any `+int+`

|
[.options-key]#`+spi-authentication-sessions--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-authentication-sessions--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `+--spi-authentication-sessions--remote--max-retries+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-authentication-sessions--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-authentication-sessions--remote--retry-base-time,role="options-extended"]
--


*CLI:* `+--spi-authentication-sessions--remote--retry-base-time+` +
*Env:* `+KC_SPI_AUTHENTICATION_SESSIONS__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== brute-force-protector
=== default-brute-force-detector
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests+`# 

[.options-description]#If concurrent logins are allowed by the brute force protection.#

[#option-extended--spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests,role="options-extended"]
--


*CLI:* `+--spi-brute-force-protector--default-brute-force-detector--allow-concurrent-requests+` +
*Env:* `+KC_SPI_BRUTE_FORCE_PROTECTOR__DEFAULT_BRUTE_FORCE_DETECTOR__ALLOW_CONCURRENT_REQUESTS+`
--



|
`+true+`, `+false+` (default)


|===
== cache-embedded
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-cache-embedded--default--authorization-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the authorization cache.#

[#option-extended--spi-cache-embedded--default--authorization-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--authorization-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__AUTHORIZATION_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--authorization-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the authorizationRevisions cache.#

[#option-extended--spi-cache-embedded--default--authorization-revisions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--authorization-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__AUTHORIZATION_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the clientSessions cache.#

[#option-extended--spi-cache-embedded--default--client-sessions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--client-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CLIENT_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--config-file+`# 

[.options-description]#Defines the file from which cache configuration should be loaded from.#

[#option-extended--spi-cache-embedded--default--config-file,role="options-extended"]
--
[.options-description-extended]#The configuration file is relative to the `conf/` directory.#

*CLI:* `+--spi-cache-embedded--default--config-file+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CONFIG_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--crl-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the crl cache.#

[#option-extended--spi-cache-embedded--default--crl-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--crl-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__CRL_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--keys-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the keys cache.#

[#option-extended--spi-cache-embedded--default--keys-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--keys-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__KEYS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--metrics-enabled+`# 

[.options-description]#If Infinispan metrics should be collected and exposed.#

[#option-extended--spi-cache-embedded--default--metrics-enabled,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--metrics-enabled+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__METRICS_ENABLED+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-cache-embedded--default--metrics-histograms-enabled+`# 

[.options-description]#Enable histograms for metrics for the embedded caches.#

[#option-extended--spi-cache-embedded--default--metrics-histograms-enabled,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--metrics-histograms-enabled+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__METRICS_HISTOGRAMS_ENABLED+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-cache-embedded--default--node-name+`# 

[.options-description]#Sets the name of the current node.#

[#option-extended--spi-cache-embedded--default--node-name,role="options-extended"]
--
[.options-description-extended]#This is a friendly name to make logs, etc. make more sense.#

*CLI:* `+--spi-cache-embedded--default--node-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__NODE_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--offline-client-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineClientSessions cache.#

[#option-extended--spi-cache-embedded--default--offline-client-sessions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--offline-client-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__OFFLINE_CLIENT_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--offline-sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the offlineSessions cache.#

[#option-extended--spi-cache-embedded--default--offline-sessions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--offline-sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__OFFLINE_SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--realm-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the realmRevisions cache.#

[#option-extended--spi-cache-embedded--default--realm-revisions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--realm-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__REALM_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--realms-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the realms cache.#

[#option-extended--spi-cache-embedded--default--realms-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--realms-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__REALMS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--sessions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the sessions cache.#

[#option-extended--spi-cache-embedded--default--sessions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--sessions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__SESSIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--site-name+`# 

[.options-description]#The name of the site where this node runs.#

[#option-extended--spi-cache-embedded--default--site-name,role="options-extended"]
--
[.options-description-extended]#Used for server hinting.#

*CLI:* `+--spi-cache-embedded--default--site-name+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__SITE_NAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-embedded--default--user-revisions-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the userRevisions cache.#

[#option-extended--spi-cache-embedded--default--user-revisions-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--user-revisions-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__USER_REVISIONS_MAX_COUNT+`
--



|any `+Integer+`

|
[.options-key]#`+spi-cache-embedded--default--users-max-count+`# 

[.options-description]#The maximum number of entries that can be stored in-memory by the users cache.#

[#option-extended--spi-cache-embedded--default--users-max-count,role="options-extended"]
--


*CLI:* `+--spi-cache-embedded--default--users-max-count+` +
*Env:* `+KC_SPI_CACHE_EMBEDDED__DEFAULT__USERS_MAX_COUNT+`
--



|any `+Integer+`


|===
== cache-remote
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-cache-remote--default--auth-realm+`# 

[.options-description]#Specifies the Infinispan server realm to be used for authentication.#

[#option-extended--spi-cache-remote--default--auth-realm,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--auth-realm+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__AUTH_REALM+`
--



|[.options-default]#`+default+`# (default) or any `+String+`

|
[.options-key]#`+spi-cache-remote--default--client-intelligence+`# 

[.options-description]#Specifies the level of intelligence the Hot Rod client should have.#

[#option-extended--spi-cache-remote--default--client-intelligence,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--client-intelligence+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CLIENT_INTELLIGENCE+`
--



|
`+BASIC+`, `+TOPOLOGY_AWARE+`, `+HASH_DISTRIBUTION_AWARE+` (default)

|
[.options-key]#`+spi-cache-remote--default--connection-pool-exhausted-action+`# 

[.options-description]#Specifies what happens when asking for a connection from a server's pool, and that pool is exhausted.#

[#option-extended--spi-cache-remote--default--connection-pool-exhausted-action,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--connection-pool-exhausted-action+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CONNECTION_POOL_EXHAUSTED_ACTION+`
--



|
`+EXCEPTION+`, `+WAIT+`, `+CREATE_NEW+` (default)

|
[.options-key]#`+spi-cache-remote--default--connection-pool-max-active+`# 

[.options-description]#Sets the maximum number of connections per Infinispan server instance.#

[#option-extended--spi-cache-remote--default--connection-pool-max-active,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--connection-pool-max-active+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__CONNECTION_POOL_MAX_ACTIVE+`
--



|[.options-default]#`+16+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-cache-remote--default--hostname+`# 

[.options-description]#The hostname of the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--hostname,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--hostname+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__HOSTNAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--password+`# 

[.options-description]#The password for the authentication to the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--password,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-username` is required as well.#

*CLI:* `+--spi-cache-remote--default--password+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PASSWORD+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--port+`# 

[.options-description]#The port of the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--port,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--port+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PORT+`
--



|[.options-default]#`+11222+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-cache-remote--default--properties-file+`# 

[.options-description]#Path to the properties file with the Hot Rod client configuration.#

[#option-extended--spi-cache-remote--default--properties-file,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--properties-file+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__PROPERTIES_FILE+`
--



|any `+File+`

|
[.options-key]#`+spi-cache-remote--default--sasl-mechanism+`# 

[.options-description]#Selects the SASL mechanism to use for the connection to the Infinispan server.#

[#option-extended--spi-cache-remote--default--sasl-mechanism,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--sasl-mechanism+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__SASL_MECHANISM+`
--



|[.options-default]#`+SCRAM-SHA-512+`# (default) or any `+String+`

|
[.options-key]#`+spi-cache-remote--default--tls-enabled+`# 

[.options-description]#Enable TLS support to communicate with a secured remote Infinispan server.#

[#option-extended--spi-cache-remote--default--tls-enabled,role="options-extended"]
--
[.options-description-extended]#Recommended to be enabled in production.#

*CLI:* `+--spi-cache-remote--default--tls-enabled+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__TLS_ENABLED+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-cache-remote--default--tls-sni-hostname+`# 

[.options-description]#Specifies the TLS SNI hostname for the connection to the Infinispan server.#

[#option-extended--spi-cache-remote--default--tls-sni-hostname,role="options-extended"]
--


*CLI:* `+--spi-cache-remote--default--tls-sni-hostname+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__TLS_SNI_HOSTNAME+`
--



|any `+String+`

|
[.options-key]#`+spi-cache-remote--default--username+`# 

[.options-description]#The username for the authentication to the external Infinispan cluster.#

[#option-extended--spi-cache-remote--default--username,role="options-extended"]
--
[.options-description-extended]#It is optional if connecting to an unsecure external Infinispan cluster. If the option is specified, `cache-remote-password` is required as well.#

*CLI:* `+--spi-cache-remote--default--username+` +
*Env:* `+KC_SPI_CACHE_REMOTE__DEFAULT__USERNAME+`
--



|any `+String+`


|===
== ciba-auth-channel
=== ciba-http-auth-channel
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri+`# 

[.options-description]#The HTTP(S) URI of the authentication channel.#

[#option-extended--spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri,role="options-extended"]
--


*CLI:* `+--spi-ciba-auth-channel--ciba-http-auth-channel--http-authentication-channel-uri+` +
*Env:* `+KC_SPI_CIBA_AUTH_CHANNEL__CIBA_HTTP_AUTH_CHANNEL__HTTP_AUTHENTICATION_CHANNEL_URI+`
--



|any `+string+`


|===
== connections-http-client
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-http-client--default--client-key-password+`# 

[.options-description]#The key password.#

[#option-extended--spi-connections-http-client--default--client-key-password,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--client-key-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEY_PASSWORD+`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--client-keystore+`# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended--spi-connections-http-client--default--client-keystore,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--client-keystore+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEYSTORE+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--client-keystore-password+`# 

[.options-description]#The key store password.#

[#option-extended--spi-connections-http-client--default--client-keystore-password,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--client-keystore-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CLIENT_KEYSTORE_PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--connection-pool-size+`# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended--spi-connections-http-client--default--connection-pool-size,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--connection-pool-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CONNECTION_POOL_SIZE+`
--



|any `+int+`

|
[.options-key]#`+spi-connections-http-client--default--connection-ttl-millis+`# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended--spi-connections-http-client--default--connection-ttl-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--connection-ttl-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__CONNECTION_TTL_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--disable-cookies+`# 

[.options-description]#Disables state (cookie) management.#

[#option-extended--spi-connections-http-client--default--disable-cookies,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--disable-cookies+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__DISABLE_COOKIES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--default--disable-trust-manager+`# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended--spi-connections-http-client--default--disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#

*CLI:* `+--spi-connections-http-client--default--disable-trust-manager+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__DISABLE_TRUST_MANAGER+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-connections-http-client--default--establish-connection-timeout-millis+`# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended--spi-connections-http-client--default--establish-connection-timeout-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--establish-connection-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__ESTABLISH_CONNECTION_TIMEOUT_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-connection-idle-time-millis+`# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended--spi-connections-http-client--default--max-connection-idle-time-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--max-connection-idle-time-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_CONNECTION_IDLE_TIME_MILLIS+`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-consumed-response-size+`# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended--spi-connections-http-client--default--max-consumed-response-size,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--max-consumed-response-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_CONSUMED_RESPONSE_SIZE+`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--default--max-pooled-per-route+`# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended--spi-connections-http-client--default--max-pooled-per-route,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--max-pooled-per-route+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__MAX_POOLED_PER_ROUTE+`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#`+spi-connections-http-client--default--proxy-mappings+`# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended--spi-connections-http-client--default--proxy-mappings,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--proxy-mappings+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__PROXY_MAPPINGS+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--default--reuse-connections+`# 

[.options-description]#If connections should be reused.#

[#option-extended--spi-connections-http-client--default--reuse-connections,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--reuse-connections+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__REUSE_CONNECTIONS+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--default--socket-timeout-millis+`# 

[.options-description]#Socket inactivity timeout.#

[#option-extended--spi-connections-http-client--default--socket-timeout-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--default--socket-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__DEFAULT__SOCKET_TIMEOUT_MILLIS+`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
=== opentelemetry
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-key-password+`# 

[.options-description]#The key password.#

[#option-extended--spi-connections-http-client--opentelemetry--client-key-password,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--client-key-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEY_PASSWORD+`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-keystore+`# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended--spi-connections-http-client--opentelemetry--client-keystore,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--client-keystore+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEYSTORE+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--client-keystore-password+`# 

[.options-description]#The key store password.#

[#option-extended--spi-connections-http-client--opentelemetry--client-keystore-password,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--client-keystore-password+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CLIENT_KEYSTORE_PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--connection-pool-size+`# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended--spi-connections-http-client--opentelemetry--connection-pool-size,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--connection-pool-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CONNECTION_POOL_SIZE+`
--



|any `+int+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--connection-ttl-millis+`# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended--spi-connections-http-client--opentelemetry--connection-ttl-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--connection-ttl-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__CONNECTION_TTL_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--disable-cookies+`# 

[.options-description]#Disables state (cookie) management.#

[#option-extended--spi-connections-http-client--opentelemetry--disable-cookies,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--disable-cookies+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__DISABLE_COOKIES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--disable-trust-manager+`# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended--spi-connections-http-client--opentelemetry--disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#

*CLI:* `+--spi-connections-http-client--opentelemetry--disable-trust-manager+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__DISABLE_TRUST_MANAGER+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-connections-http-client--opentelemetry--establish-connection-timeout-millis+`# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended--spi-connections-http-client--opentelemetry--establish-connection-timeout-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--establish-connection-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__ESTABLISH_CONNECTION_TIMEOUT_MILLIS+`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-connection-idle-time-millis+`# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended--spi-connections-http-client--opentelemetry--max-connection-idle-time-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--max-connection-idle-time-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_CONNECTION_IDLE_TIME_MILLIS+`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-consumed-response-size+`# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended--spi-connections-http-client--opentelemetry--max-consumed-response-size,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--max-consumed-response-size+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_CONSUMED_RESPONSE_SIZE+`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--max-pooled-per-route+`# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended--spi-connections-http-client--opentelemetry--max-pooled-per-route,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--max-pooled-per-route+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__MAX_POOLED_PER_ROUTE+`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--proxy-mappings+`# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended--spi-connections-http-client--opentelemetry--proxy-mappings,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--proxy-mappings+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__PROXY_MAPPINGS+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--reuse-connections+`# 

[.options-description]#If connections should be reused.#

[#option-extended--spi-connections-http-client--opentelemetry--reuse-connections,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--reuse-connections+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__REUSE_CONNECTIONS+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-http-client--opentelemetry--socket-timeout-millis+`# 

[.options-description]#Socket inactivity timeout.#

[#option-extended--spi-connections-http-client--opentelemetry--socket-timeout-millis,role="options-extended"]
--


*CLI:* `+--spi-connections-http-client--opentelemetry--socket-timeout-millis+` +
*Env:* `+KC_SPI_CONNECTIONS_HTTP_CLIENT__OPENTELEMETRY__SOCKET_TIMEOUT_MILLIS+`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
== connections-jpa
=== quarkus
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-connections-jpa--quarkus--initialize-empty+`# 

[.options-description]#Initialize database if empty.#

[#option-extended--spi-connections-jpa--quarkus--initialize-empty,role="options-extended"]
--
[.options-description-extended]#If set to false the database has to be manually initialized. If you want to manually initialize the database set migrationStrategy to manual which will create a file with SQL commands to initialize the database.#

*CLI:* `+--spi-connections-jpa--quarkus--initialize-empty+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__INITIALIZE_EMPTY+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-connections-jpa--quarkus--migration-export+`# 

[.options-description]#Path for where to write manual database initialization/migration file.#

[#option-extended--spi-connections-jpa--quarkus--migration-export,role="options-extended"]
--


*CLI:* `+--spi-connections-jpa--quarkus--migration-export+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__MIGRATION_EXPORT+`
--



|any `+string+`

|
[.options-key]#`+spi-connections-jpa--quarkus--migration-strategy+`# 

[.options-description]#Strategy to use to migrate database.#

[#option-extended--spi-connections-jpa--quarkus--migration-strategy,role="options-extended"]
--
[.options-description-extended]#Valid values are update, manual and validate. Update will automatically migrate the database schema. Manual will export the required changes to a file with SQL commands that you can manually execute on the database. Validate will simply check if the database is up-to-date.#

*CLI:* `+--spi-connections-jpa--quarkus--migration-strategy+` +
*Env:* `+KC_SPI_CONNECTIONS_JPA__QUARKUS__MIGRATION_STRATEGY+`
--



|
`+update+` (default), `+manual+`, `+validate+`


|===
== credential
=== keycloak-password
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-credential--keycloak-password--validations-counter-tags+`# 

[.options-description]#Comma-separated list of tags to be used when publishing password validation counter metric.#

[#option-extended--spi-credential--keycloak-password--validations-counter-tags,role="options-extended"]
--


*CLI:* `+--spi-credential--keycloak-password--validations-counter-tags+` +
*Env:* `+KC_SPI_CREDENTIAL__KEYCLOAK_PASSWORD__VALIDATIONS_COUNTER_TAGS+`
--



|
`+realm+`, `+algorithm+`, `+hashing_strength+`, `+outcome+`


|===
== crl-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-crl-storage--infinispan--cache-time+`# 

[.options-description]#Interval in seconds that the CRL is cached.#

[#option-extended--spi-crl-storage--infinispan--cache-time,role="options-extended"]
--
[.options-description-extended]#The next update time of the CRL is always a minimum if present.
Zero or a negative value means CRL is cached until the next update time specified in the CRL (or infinite if the
CRL does not contain the next update).#

*CLI:* `+--spi-crl-storage--infinispan--cache-time+` +
*Env:* `+KC_SPI_CRL_STORAGE__INFINISPAN__CACHE_TIME+`
--



|[.options-default]#`+-1+`# (default) or any `+int+`

|
[.options-key]#`+spi-crl-storage--infinispan--min-time-between-requests+`# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the CRL.#

[#option-extended--spi-crl-storage--infinispan--min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The CRL is not updated
from the URL again until this minimum time has passed since the previous refresh. In theory
this option is never used if the CRL is refreshed correctly in the next update time.
The interval should be a positive number. Default 10 seconds.#

*CLI:* `+--spi-crl-storage--infinispan--min-time-between-requests+` +
*Env:* `+KC_SPI_CRL_STORAGE__INFINISPAN__MIN_TIME_BETWEEN_REQUESTS+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== datastore
=== legacy
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-datastore--legacy--allow-migrate-existing-database-to-snapshot+`# 

[.options-description]#By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.#

[#option-extended--spi-datastore--legacy--allow-migrate-existing-database-to-snapshot,role="options-extended"]
--
[.options-description-extended]#As an attempt of doing this indicates that you are trying to run development server against production database, which can result in a loss or corruption of data, and also does not allow upgrading. If it is really intended, you can use this option, which will allow to use nightly/development server against production database when explicitly switch to true. This option is recommended just in the development environments and should be never used in the production!#

*CLI:* `+--spi-datastore--legacy--allow-migrate-existing-database-to-snapshot+` +
*Env:* `+KC_SPI_DATASTORE__LEGACY__ALLOW_MIGRATE_EXISTING_DATABASE_TO_SNAPSHOT+`
--



|
`+true+`, `+false+` (default)


|===
== dblock
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-dblock--jpa--lock-wait-timeout+`# 

[.options-description]#The maximum time to wait when waiting to release a database lock.#

[#option-extended--spi-dblock--jpa--lock-wait-timeout,role="options-extended"]
--


*CLI:* `+--spi-dblock--jpa--lock-wait-timeout+` +
*Env:* `+KC_SPI_DBLOCK__JPA__LOCK_WAIT_TIMEOUT+`
--



|any `+int+`


|===
== events-listener
=== email
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-events-listener--email--exclude-events+`# 

[.options-description]#A comma-separated list of events that should not be sent via email to the user's account.#

[#option-extended--spi-events-listener--email--exclude-events,role="options-extended"]
--


*CLI:* `+--spi-events-listener--email--exclude-events+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__EMAIL__EXCLUDE_EVENTS+`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`

|
[.options-key]#`+spi-events-listener--email--include-events+`# 

[.options-description]#A comma-separated list of events that should be sent via email to the user's account.#

[#option-extended--spi-events-listener--email--include-events,role="options-extended"]
--


*CLI:* `+--spi-events-listener--email--include-events+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__EMAIL__INCLUDE_EVENTS+`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`


|===
=== jboss-logging
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-events-listener--jboss-logging--error-level+`# 

[.options-description]#The log level for error messages.#

[#option-extended--spi-events-listener--jboss-logging--error-level,role="options-extended"]
--


*CLI:* `+--spi-events-listener--jboss-logging--error-level+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__ERROR_LEVEL+`
--



|
`+debug+`, `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+` (default)

|
[.options-key]#`+spi-events-listener--jboss-logging--include-representation+`# 

[.options-description]#When "true" the "representation" field with the JSON admin object is also added to the message.#

[#option-extended--spi-events-listener--jboss-logging--include-representation,role="options-extended"]
--
[.options-description-extended]#The realm should be also configured to include representation for the admin events.#

*CLI:* `+--spi-events-listener--jboss-logging--include-representation+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__INCLUDE_REPRESENTATION+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-events-listener--jboss-logging--quotes+`# 

[.options-description]#The quotes to use for values, it should be one character like " or '.#

[#option-extended--spi-events-listener--jboss-logging--quotes,role="options-extended"]
--
[.options-description-extended]#Use "none" if quotes are not needed.#

*CLI:* `+--spi-events-listener--jboss-logging--quotes+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__QUOTES+`
--



|[.options-default]#`+"+`# (default) or any `+string+`

|
[.options-key]#`+spi-events-listener--jboss-logging--sanitize+`# 

[.options-description]#If true the log messages are sanitized to avoid line breaks.#

[#option-extended--spi-events-listener--jboss-logging--sanitize,role="options-extended"]
--
[.options-description-extended]#If false messages are not sanitized.#

*CLI:* `+--spi-events-listener--jboss-logging--sanitize+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__SANITIZE+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-events-listener--jboss-logging--success-level+`# 

[.options-description]#The log level for success messages.#

[#option-extended--spi-events-listener--jboss-logging--success-level,role="options-extended"]
--


*CLI:* `+--spi-events-listener--jboss-logging--success-level+` +
*Env:* `+KC_SPI_EVENTS_LISTENER__JBOSS_LOGGING__SUCCESS_LEVEL+`
--



|
`+debug+` (default), `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+`


|===
== export
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-export--dir--dir+`# 

[.options-description]#Directory to export to#

[#option-extended--spi-export--dir--dir,role="options-extended"]
--


*CLI:* `+--spi-export--dir--dir+` +
*Env:* `+KC_SPI_EXPORT__DIR__DIR+`
--



|any `+string+`

|
[.options-key]#`+spi-export--dir--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-export--dir--realm-name,role="options-extended"]
--


*CLI:* `+--spi-export--dir--realm-name+` +
*Env:* `+KC_SPI_EXPORT__DIR__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-export--dir--users-export-strategy+`# 

[.options-description]#Users export strategy#

[#option-extended--spi-export--dir--users-export-strategy,role="options-extended"]
--


*CLI:* `+--spi-export--dir--users-export-strategy+` +
*Env:* `+KC_SPI_EXPORT__DIR__USERS_EXPORT_STRATEGY+`
--



|[.options-default]#`+DIFFERENT_FILES+`# (default) or any `+string+`

|
[.options-key]#`+spi-export--dir--users-per-file+`# 

[.options-description]#Users per exported file#

[#option-extended--spi-export--dir--users-per-file,role="options-extended"]
--


*CLI:* `+--spi-export--dir--users-per-file+` +
*Env:* `+KC_SPI_EXPORT__DIR__USERS_PER_FILE+`
--



|[.options-default]#`+50+`# (default) or any `+int+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-export--single-file--file+`# 

[.options-description]#File to export to#

[#option-extended--spi-export--single-file--file,role="options-extended"]
--


*CLI:* `+--spi-export--single-file--file+` +
*Env:* `+KC_SPI_EXPORT__SINGLE_FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-export--single-file--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-export--single-file--realm-name,role="options-extended"]
--


*CLI:* `+--spi-export--single-file--realm-name+` +
*Env:* `+KC_SPI_EXPORT__SINGLE_FILE__REALM_NAME+`
--



|any `+string+`


|===
== group
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-group--jpa--escape-slashes-in-group-path+`# 

[.options-description]#If true slashes `/` in group names are escaped with the character `~` when converted to paths.#

[#option-extended--spi-group--jpa--escape-slashes-in-group-path,role="options-extended"]
--


*CLI:* `+--spi-group--jpa--escape-slashes-in-group-path+` +
*Env:* `+KC_SPI_GROUP__JPA__ESCAPE_SLASHES_IN_GROUP_PATH+`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#`+spi-group--jpa--searchable-attributes+`# 

[.options-description]#The list of attributes separated by comma that are allowed in client attribute searches.#

[#option-extended--spi-group--jpa--searchable-attributes,role="options-extended"]
--


*CLI:* `+--spi-group--jpa--searchable-attributes+` +
*Env:* `+KC_SPI_GROUP__JPA__SEARCHABLE_ATTRIBUTES+`
--



|any `+string+`


|===
== import
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-import--dir--dir+`# 

[.options-description]#Directory to import from#

[#option-extended--spi-import--dir--dir,role="options-extended"]
--


*CLI:* `+--spi-import--dir--dir+` +
*Env:* `+KC_SPI_IMPORT__DIR__DIR+`
--



|any `+string+`

|
[.options-key]#`+spi-import--dir--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-import--dir--realm-name,role="options-extended"]
--


*CLI:* `+--spi-import--dir--realm-name+` +
*Env:* `+KC_SPI_IMPORT__DIR__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-import--dir--strategy+`# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended--spi-import--dir--strategy,role="options-extended"]
--


*CLI:* `+--spi-import--dir--strategy+` +
*Env:* `+KC_SPI_IMPORT__DIR__STRATEGY+`
--



|any `+string+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-import--single-file--file+`# 

[.options-description]#File to import from#

[#option-extended--spi-import--single-file--file,role="options-extended"]
--


*CLI:* `+--spi-import--single-file--file+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-import--single-file--realm-name+`# 

[.options-description]#Realm to export#

[#option-extended--spi-import--single-file--realm-name,role="options-extended"]
--


*CLI:* `+--spi-import--single-file--realm-name+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__REALM_NAME+`
--



|any `+string+`

|
[.options-key]#`+spi-import--single-file--strategy+`# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended--spi-import--single-file--strategy,role="options-extended"]
--


*CLI:* `+--spi-import--single-file--strategy+` +
*Env:* `+KC_SPI_IMPORT__SINGLE_FILE__STRATEGY+`
--



|any `+string+`


|===
== jgroups-mtls
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-jgroups-mtls--default--enabled+`# 

[.options-description]#Encrypts the network communication between Keycloak servers.#

[#option-extended--spi-jgroups-mtls--default--enabled,role="options-extended"]
--
[.options-description-extended]#If no additional parameters about a keystore and truststore are provided, ephemeral key pairs and certificates are created and rotated automatically, which is recommended for standard setups.#

*CLI:* `+--spi-jgroups-mtls--default--enabled+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__ENABLED+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-jgroups-mtls--default--keystore-file+`# 

[.options-description]#The Keystore file path.#

[#option-extended--spi-jgroups-mtls--default--keystore-file,role="options-extended"]
--
[.options-description-extended]#The Keystore must contain the certificate to use by the TLS protocol. By default, it looks up `cache-mtls-keystore.p12` under conf/ directory.#

*CLI:* `+--spi-jgroups-mtls--default--keystore-file+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__KEYSTORE_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-jgroups-mtls--default--keystore-password+`# 

[.options-description]#The password to access the Keystore.#

[#option-extended--spi-jgroups-mtls--default--keystore-password,role="options-extended"]
--


*CLI:* `+--spi-jgroups-mtls--default--keystore-password+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__KEYSTORE_PASSWORD+`
--



|any `+Password+`

|
[.options-key]#`+spi-jgroups-mtls--default--rotation+`# 

[.options-description]#Rotation period in days of automatic JGroups MTLS certificates.#

[#option-extended--spi-jgroups-mtls--default--rotation,role="options-extended"]
--


*CLI:* `+--spi-jgroups-mtls--default--rotation+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__ROTATION+`
--



|[.options-default]#`+30+`# (default) or any `+Integer+`

|
[.options-key]#`+spi-jgroups-mtls--default--truststore-file+`# 

[.options-description]#The Truststore file path.#

[#option-extended--spi-jgroups-mtls--default--truststore-file,role="options-extended"]
--
[.options-description-extended]#It should contain the trusted certificates or the Certificate Authority that signed the certificates. By default, it lookup `cache-mtls-truststore.p12` under conf/ directory.#

*CLI:* `+--spi-jgroups-mtls--default--truststore-file+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__TRUSTSTORE_FILE+`
--



|any `+String+`

|
[.options-key]#`+spi-jgroups-mtls--default--truststore-password+`# 

[.options-description]#The password to access the Truststore.#

[#option-extended--spi-jgroups-mtls--default--truststore-password,role="options-extended"]
--


*CLI:* `+--spi-jgroups-mtls--default--truststore-password+` +
*Env:* `+KC_SPI_JGROUPS_MTLS__DEFAULT__TRUSTSTORE_PASSWORD+`
--



|any `+Password+`


|===
== load-balancer-check
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-load-balancer-check--remote--poll-interval+`# 

[.options-description]#The Remote caches poll interval, in milliseconds, for connection availability#

[#option-extended--spi-load-balancer-check--remote--poll-interval,role="options-extended"]
--


*CLI:* `+--spi-load-balancer-check--remote--poll-interval+` +
*Env:* `+KC_SPI_LOAD_BALANCER_CHECK__REMOTE__POLL_INTERVAL+`
--



|[.options-default]#`+5000+`# (default) or any `+int+`


|===
== login-failure
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-login-failure--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-login-failure--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `+--spi-login-failure--remote--max-retries+` +
*Env:* `+KC_SPI_LOGIN_FAILURE__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-login-failure--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-login-failure--remote--retry-base-time,role="options-extended"]
--


*CLI:* `+--spi-login-failure--remote--retry-base-time+` +
*Env:* `+KC_SPI_LOGIN_FAILURE__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== password-hashing
=== argon2
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-password-hashing--argon2--cpu-cores+`# 

[.options-description]#Maximum parallel CPU cores to use for hashing#

[#option-extended--spi-password-hashing--argon2--cpu-cores,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--cpu-cores+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__CPU_CORES+`
--



|any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--hash-length+`# 

[.options-description]#Hash length#

[#option-extended--spi-password-hashing--argon2--hash-length,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--hash-length+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__HASH_LENGTH+`
--



|[.options-default]#`+32+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--iterations+`# 

[.options-description]#Iterations#

[#option-extended--spi-password-hashing--argon2--iterations,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--iterations+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__ITERATIONS+`
--



|[.options-default]#`+5+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--memory+`# 

[.options-description]#Memory size (KB)#

[#option-extended--spi-password-hashing--argon2--memory,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--memory+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__MEMORY+`
--



|[.options-default]#`+7168+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--parallelism+`# 

[.options-description]#Parallelism#

[#option-extended--spi-password-hashing--argon2--parallelism,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--parallelism+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__PARALLELISM+`
--



|[.options-default]#`+1+`# (default) or any `+int+`

|
[.options-key]#`+spi-password-hashing--argon2--type+`# 

[.options-description]#Type#

[#option-extended--spi-password-hashing--argon2--type,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--type+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__TYPE+`
--



|
`+id+` (default), `+d+`, `+i+`

|
[.options-key]#`+spi-password-hashing--argon2--version+`# 

[.options-description]#Version#

[#option-extended--spi-password-hashing--argon2--version,role="options-extended"]
--


*CLI:* `+--spi-password-hashing--argon2--version+` +
*Env:* `+KC_SPI_PASSWORD_HASHING__ARGON2__VERSION+`
--



|
`+1.3+` (default), `+1.0+`


|===
== public-key-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-public-key-storage--infinispan--max-cache-time+`# 

[.options-description]#Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.#

[#option-extended--spi-public-key-storage--infinispan--max-cache-time,role="options-extended"]
--
[.options-description-extended]#When all keys for the entry are retrieved there is no way to detect if a key is missing (different to the case when the key is retrieved via ID for example). In that situation this option forces a refresh from time to time. Default 24 hours.#

*CLI:* `+--spi-public-key-storage--infinispan--max-cache-time+` +
*Env:* `+KC_SPI_PUBLIC_KEY_STORAGE__INFINISPAN__MAX_CACHE_TIME+`
--



|[.options-default]#`+86400+`# (default) or any `+int+`

|
[.options-key]#`+spi-public-key-storage--infinispan--min-time-between-requests+`# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the new public keys.#

[#option-extended--spi-public-key-storage--infinispan--min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The server will always try to download new public keys when a single key is requested and not found. However it will avoid the download if the previous refresh was done less than 10 seconds ago (by default). This behavior is used to avoid DoS attacks against the external keys endpoint.#

*CLI:* `+--spi-public-key-storage--infinispan--min-time-between-requests+` +
*Env:* `+KC_SPI_PUBLIC_KEY_STORAGE__INFINISPAN__MIN_TIME_BETWEEN_REQUESTS+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== required-action
=== CONFIGURE_RECOVERY_AUTHN_CODES
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_RECOVERY_AUTHN_CODES__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`

|
[.options-key]#`+spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold+`# 

[.options-description]#When user has smaller amount of remaining recovery codes on his account than the value configured here, account console will show warning to the user, which will recommend him to setup new set of recovery codes.#

[#option-extended--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold,role="options-extended"]
--


*CLI:* `+--spi-required-action--CONFIGURE_RECOVERY_AUTHN_CODES--warning_threshold+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_RECOVERY_AUTHN_CODES__WARNING_THRESHOLD+`
--



|[.options-default]#`+4+`# (default) or any `+Integer+`


|===
=== CONFIGURE_TOTP
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--CONFIGURE_TOTP--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--CONFIGURE_TOTP--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--CONFIGURE_TOTP--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__CONFIGURE_TOTP__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== TERMS_AND_CONDITIONS
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--TERMS_AND_CONDITIONS--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--TERMS_AND_CONDITIONS--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--TERMS_AND_CONDITIONS--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__TERMS_AND_CONDITIONS__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== UPDATE_PASSWORD
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--UPDATE_PASSWORD--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--UPDATE_PASSWORD--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--UPDATE_PASSWORD--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_PASSWORD__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== UPDATE_PROFILE
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--UPDATE_PROFILE--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--UPDATE_PROFILE--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--UPDATE_PROFILE--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_PROFILE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== VERIFY_EMAIL
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--VERIFY_EMAIL--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--VERIFY_EMAIL--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--VERIFY_EMAIL--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__VERIFY_EMAIL__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== VERIFY_PROFILE
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--VERIFY_PROFILE--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--VERIFY_PROFILE--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--VERIFY_PROFILE--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__VERIFY_PROFILE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== delete_credential
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--delete_credential--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--delete_credential--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--delete_credential--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__DELETE_CREDENTIAL__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== idp_link
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--idp_link--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--idp_link--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--idp_link--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__IDP_LINK__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== update_user_locale
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--update_user_locale--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--update_user_locale--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--update_user_locale--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__UPDATE_USER_LOCALE__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== webauthn-register
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--webauthn-register--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--webauthn-register--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--webauthn-register--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__WEBAUTHN_REGISTER__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
=== webauthn-register-passwordless
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-required-action--webauthn-register-passwordless--max_auth_age+`# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended--spi-required-action--webauthn-register-passwordless--max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console.#

*CLI:* `+--spi-required-action--webauthn-register-passwordless--max_auth_age+` +
*Env:* `+KC_SPI_REQUIRED_ACTION__WEBAUTHN_REGISTER_PASSWORDLESS__MAX_AUTH_AGE+`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
== resource-encoding
=== gzip
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-resource-encoding--gzip--excluded-content-types+`# 

[.options-description]#A space separated list of content-types to exclude from encoding.#

[#option-extended--spi-resource-encoding--gzip--excluded-content-types,role="options-extended"]
--


*CLI:* `+--spi-resource-encoding--gzip--excluded-content-types+` +
*Env:* `+KC_SPI_RESOURCE_ENCODING__GZIP__EXCLUDED_CONTENT_TYPES+`
--



|[.options-default]#`+image/png image/jpeg+`# (default) or any `+string+`


|===
== security-profile
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-security-profile--default--name+`# 

[.options-description]#Name for the security configuration file to use.#

[#option-extended--spi-security-profile--default--name,role="options-extended"]
--
[.options-description-extended]#File `name`.json is searched in classapth and `conf` installation folder.#

*CLI:* `+--spi-security-profile--default--name+` +
*Env:* `+KC_SPI_SECURITY_PROFILE__DEFAULT__NAME+`
--



|any `+string+`


|===
== single-use-object
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-single-use-object--infinispan--persist-revoked-tokens+`# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended--spi-single-use-object--infinispan--persist-revoked-tokens,role="options-extended"]
--


*CLI:* `+--spi-single-use-object--infinispan--persist-revoked-tokens+` +
*Env:* `+KC_SPI_SINGLE_USE_OBJECT__INFINISPAN__PERSIST_REVOKED_TOKENS+`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-single-use-object--remote--persist-revoked-tokens+`# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended--spi-single-use-object--remote--persist-revoked-tokens,role="options-extended"]
--


*CLI:* `+--spi-single-use-object--remote--persist-revoked-tokens+` +
*Env:* `+KC_SPI_SINGLE_USE_OBJECT__REMOTE__PERSIST_REVOKED_TOKENS+`
--



|
`+true+` (default), `+false+`


|===
== sticky-session-encoder
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-sticky-session-encoder--infinispan--should-attach-route+`# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended--spi-sticky-session-encoder--infinispan--should-attach-route,role="options-extended"]
--


*CLI:* `+--spi-sticky-session-encoder--infinispan--should-attach-route+` +
*Env:* `+KC_SPI_STICKY_SESSION_ENCODER__INFINISPAN__SHOULD_ATTACH_ROUTE+`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-sticky-session-encoder--remote--should-attach-route+`# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended--spi-sticky-session-encoder--remote--should-attach-route,role="options-extended"]
--


*CLI:* `+--spi-sticky-session-encoder--remote--should-attach-route+` +
*Env:* `+KC_SPI_STICKY_SESSION_ENCODER__REMOTE__SHOULD_ATTACH_ROUTE+`
--



|
`+true+` (default), `+false+`


|===
== truststore
=== file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-truststore--file--file+`# 

[.options-description]#DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.#

[#option-extended--spi-truststore--file--file,role="options-extended"]
--


*CLI:* `+--spi-truststore--file--file+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__FILE+`
--



|any `+string+`

|
[.options-key]#`+spi-truststore--file--hostname-verification-policy+`# 

[.options-description]#DEPRECATED: The hostname verification policy.#

[#option-extended--spi-truststore--file--hostname-verification-policy,role="options-extended"]
--


*CLI:* `+--spi-truststore--file--hostname-verification-policy+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__HOSTNAME_VERIFICATION_POLICY+`
--



|
`+ANY+`, `+WILDCARD+`, `+STRICT+`, `+DEFAULT+` (default)

|
[.options-key]#`+spi-truststore--file--password+`# 

[.options-description]#DEPRECATED: The trust store password.#

[#option-extended--spi-truststore--file--password,role="options-extended"]
--


*CLI:* `+--spi-truststore--file--password+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__PASSWORD+`
--



|any `+string+`

|
[.options-key]#`+spi-truststore--file--type+`# 

[.options-description]#DEPRECATED: Type of the truststore.#

[#option-extended--spi-truststore--file--type,role="options-extended"]
--
[.options-description-extended]#If not provided, the type would be detected based on the truststore file extension or platform default type.#

*CLI:* `+--spi-truststore--file--type+` +
*Env:* `+KC_SPI_TRUSTSTORE__FILE__TYPE+`
--



|any `+string+`


|===
== user-profile
=== declarative-user-profile
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-profile--declarative-user-profile--admin-read-only-attributes+`# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so administrators can't change them.#

[#option-extended--spi-user-profile--declarative-user-profile--admin-read-only-attributes,role="options-extended"]
--


*CLI:* `+--spi-user-profile--declarative-user-profile--admin-read-only-attributes+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__ADMIN_READ_ONLY_ATTRIBUTES+`
--



|any `+MultivaluedString+`

|
[.options-key]#`+spi-user-profile--declarative-user-profile--max-email-local-part-length+`# 

[.options-description]#To set user profile max email local part length#

[#option-extended--spi-user-profile--declarative-user-profile--max-email-local-part-length,role="options-extended"]
--


*CLI:* `+--spi-user-profile--declarative-user-profile--max-email-local-part-length+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__MAX_EMAIL_LOCAL_PART_LENGTH+`
--



|any `+String+`

|
[.options-key]#`+spi-user-profile--declarative-user-profile--read-only-attributes+`# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so users can't change them.#

[#option-extended--spi-user-profile--declarative-user-profile--read-only-attributes,role="options-extended"]
--


*CLI:* `+--spi-user-profile--declarative-user-profile--read-only-attributes+` +
*Env:* `+KC_SPI_USER_PROFILE__DECLARATIVE_USER_PROFILE__READ_ONLY_ATTRIBUTES+`
--



|any `+MultivaluedString+`


|===
== user-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-sessions--infinispan--max-batch-size+`# 

[.options-description]#Maximum size of a batch size (only applicable to persistent sessions#

[#option-extended--spi-user-sessions--infinispan--max-batch-size,role="options-extended"]
--


*CLI:* `+--spi-user-sessions--infinispan--max-batch-size+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__MAX_BATCH_SIZE+`
--



|[.options-default]#`+4+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override+`# 

[.options-description]#Override how long offline client sessions should be kept in memory in seconds#

[#option-extended--spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override,role="options-extended"]
--


*CLI:* `+--spi-user-sessions--infinispan--offline-client-session-cache-entry-lifespan-override+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__OFFLINE_CLIENT_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE+`
--



|any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override+`# 

[.options-description]#Override how long offline user sessions should be kept in memory in seconds#

[#option-extended--spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override,role="options-extended"]
--


*CLI:* `+--spi-user-sessions--infinispan--offline-session-cache-entry-lifespan-override+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__OFFLINE_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE+`
--



|any `+int+`

|
[.options-key]#`+spi-user-sessions--infinispan--use-caches+`# 

[.options-description]#Enable or disable caches.#

[#option-extended--spi-user-sessions--infinispan--use-caches,role="options-extended"]
--
[.options-description-extended]#Enabled by default unless the external feature to use only external remote caches is used#

*CLI:* `+--spi-user-sessions--infinispan--use-caches+` +
*Env:* `+KC_SPI_USER_SESSIONS__INFINISPAN__USE_CACHES+`
--



|
`+true+`, `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-user-sessions--remote--batch-size+`# 

[.options-description]#Batch size when streaming session from the remote cache#

[#option-extended--spi-user-sessions--remote--batch-size,role="options-extended"]
--


*CLI:* `+--spi-user-sessions--remote--batch-size+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__BATCH_SIZE+`
--



|[.options-default]#`+1024+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--remote--max-retries+`# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended--spi-user-sessions--remote--max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `+--spi-user-sessions--remote--max-retries+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__MAX_RETRIES+`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#`+spi-user-sessions--remote--retry-base-time+`# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended--spi-user-sessions--remote--retry-base-time,role="options-extended"]
--


*CLI:* `+--spi-user-sessions--remote--retry-base-time+` +
*Env:* `+KC_SPI_USER_SESSIONS__REMOTE__RETRY_BASE_TIME+`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== well-known
=== oauth-authorization-server
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-well-known--oauth-authorization-server--include-client-scopes+`# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended--spi-well-known--oauth-authorization-server--include-client-scopes,role="options-extended"]
--


*CLI:* `+--spi-well-known--oauth-authorization-server--include-client-scopes+` +
*Env:* `+KC_SPI_WELL_KNOWN__OAUTH_AUTHORIZATION_SERVER__INCLUDE_CLIENT_SCOPES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-well-known--oauth-authorization-server--openid-configuration-override+`# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended--spi-well-known--oauth-authorization-server--openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#

*CLI:* `+--spi-well-known--oauth-authorization-server--openid-configuration-override+` +
*Env:* `+KC_SPI_WELL_KNOWN__OAUTH_AUTHORIZATION_SERVER__OPENID_CONFIGURATION_OVERRIDE+`
--



|any `+string+`


|===
=== openid-configuration
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#`+spi-well-known--openid-configuration--include-client-scopes+`# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended--spi-well-known--openid-configuration--include-client-scopes,role="options-extended"]
--


*CLI:* `+--spi-well-known--openid-configuration--include-client-scopes+` +
*Env:* `+KC_SPI_WELL_KNOWN__OPENID_CONFIGURATION__INCLUDE_CLIENT_SCOPES+`
--



|
`+true+` (default), `+false+`

|
[.options-key]#`+spi-well-known--openid-configuration--openid-configuration-override+`# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended--spi-well-known--openid-configuration--openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#

*CLI:* `+--spi-well-known--openid-configuration--openid-configuration-override+` +
*Env:* `+KC_SPI_WELL_KNOWN__OPENID_CONFIGURATION__OPENID_CONFIGURATION_OVERRIDE+`
--



|any `+string+`


|===


