{"Name":"keycloak","ID":"go.mondoo.com/mql/providers/keycloak","Version":"13.0.0","ConnectionTypes":["keycloak"],"CrossProviderTypes":null,"Connectors":[{"Name":"keycloak","Use":"keycloak","Short":"a Keycloak server","Long":"Use the keycloak provider to query the realms, clients, roles, groups, users, identity providers and authentication flows of a Keycloak server.\n\nThere are two ways to authenticate. An admin user signs in with the password\ngrant against the admin-cli client, which is the quickest way to try the\nprovider. A service account on a confidential client uses the client credentials\ngrant and holds only the roles it was granted, so it can be limited to the view\nroles of one realm.\n\nA service account needs the realm-management view roles (view-realm, view-users,\nview-clients, view-identity-providers and view-authorization) on every realm it\nreads. Reading every realm of a server needs the view-realm role of the\nmaster realm's realm-management client instead.\n\nExamples:\n  mql shell keycloak --url https://keycloak.example.com --username admin --password \u003cpassword\u003e\n  mql shell keycloak --url https://keycloak.example.com --realm production --client-id mondoo-scanner --client-secret \u003csecret\u003e\n  mql scan keycloak --url https://keycloak.example.com --username admin --password \u003cpassword\u003e --discover realms\n\nNotes:\n  KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID, KEYCLOAK_CLIENT_SECRET,\n  KEYCLOAK_USERNAME and KEYCLOAK_PASSWORD supply the same values as the flags.\n  A server installed under a context path keeps that path in the URL, for\n  example https://keycloak.example.com/auth.\n","Flags":[{"Long":"url","Desc":"Base URL of the Keycloak server, for example https://keycloak.example.com","Type":3},{"Long":"realm","Desc":"Scope the scan to a single realm instead of every realm the credentials can read","Type":3},{"Long":"auth-realm","Desc":"Realm the token is requested from (defaults to master for a user, or the scanned realm for a service account)","Type":3},{"Long":"client-id","Desc":"Client the token is requested for (defaults to admin-cli for a user)","Type":3},{"Long":"client-secret","Desc":"Secret of a confidential client, which selects service account authentication","Type":3},{"Long":"username","Desc":"Admin user to authenticate as, which selects password authentication","Type":3},{"Long":"password","Desc":"Password of the admin user","Type":3},{"Long":"ca-cert","Desc":"Certificate authority to trust for the server certificate, either the PEM itself or a path to it","Type":3}],"Discovery":["all","auto","realms"]}],"AssetUrlTrees":[{"path_segments":["technology=saas","provider=keycloak"],"key":"host","values":{"*":{"key":"realm","values":{"*":null},"title":"Realm"}},"title":"Host"}],"Platforms":[{"name":"keycloak-realm","title":"Keycloak Realm","family":["keycloak"],"kind":["api"],"runtime":["keycloak"]}]}