{"resources":{"keycloak":{"id":"keycloak","name":"keycloak","fields":{"authenticationFlow":{"name":"authenticationFlow","type":"\u001bkeycloak.authenticationFlow","title":"Keycloak Authentication Flow","desc":"An ordered set of authentication steps a realm can bind to browser login, the direct grant, registration or credential reset. The `executions` field lists the steps with the requirement each one carries, which is what makes a missing second factor visible: a browser flow whose only credential step is a password, with no REQUIRED or CONDITIONAL one-time password step, accepts a single factor. The realm's `browserFlow` and `directGrantFlow` fields name which flows are actually in force.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"client":{"name":"client","type":"\u001bkeycloak.client","title":"Keycloak Client","desc":"An application or service registered with a realm, and the OAuth flows and redirect targets it is trusted with. Query `publicClient` for whether the client authenticates itself at all, `redirectUris` together with `hasWildcardRedirectUri` for where an authorization code may be sent, `webOrigins` with `hasWildcardWebOrigin` for cross-origin access, `standardFlowEnabled`, `implicitFlowEnabled`, `directAccessGrantsEnabled` and `serviceAccountsEnabled` for which grants it may use, `consentRequired` for whether a user is asked before scopes are released, and `pkceCodeChallengeMethod` for whether the code exchange is bound to the requesting client. A public client with a wildcard redirect URI lets an attacker collect authorization codes for any user of the realm. Select a client with `keycloak.clients.where(clientId == \"kubernetes\")`.","provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"clientPolicy":{"name":"clientPolicy","type":"\u001bkeycloak.clientPolicy","title":"Keycloak Client Policy","desc":"A rule that applies client profiles to the clients its conditions match. The `enabled` field decides whether it is in force at all, `profiles` names the profiles it applies, and `conditionTypes` reports what it matches on. A policy that is disabled, or that names no profile, enforces nothing.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"clientProfile":{"name":"clientProfile","type":"\u001bkeycloak.clientProfile","title":"Keycloak Client Profile","desc":"A named set of requirements a client must meet, called executors, such as demanding a proof key or refusing a public client. A profile is inert until a client policy applies it, so `keycloak.realm.clientPolicies` is what says whether it is in force. Query `executorTypes` for what the profile demands.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"clientScope":{"name":"clientScope","type":"\u001bkeycloak.clientScope","title":"Keycloak Client Scope","desc":"A named set of protocol mappers and role scope mappings that a client can attach to its tokens. A scope in a client's default list is applied to every token without the request asking for it, so a mapper added here reaches every client that carries the scope. Query `protocolMappers` for what the scope puts into a token, `includeInTokenScope` for whether the scope name appears in the token's scope claim, and `scopeMappings` for the roles it lets through. Select a scope with `keycloak.realms.first.clientScopes.where(name == \"profile\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"clientScopes":{"name":"clientScopes","type":"\u0019\u001bkeycloak.clientScope","title":"Client scopes across every realm in scope","provider":"go.mondoo.com/mql/providers/keycloak"},"clients":{"name":"clients","type":"\u0019\u001bkeycloak.client","title":"Clients across every realm in scope","provider":"go.mondoo.com/mql/providers/keycloak"},"component":{"name":"component","type":"\u001bkeycloak.component","title":"Keycloak Component","desc":"A pluggable component of a realm, most often a user federation provider or a key provider. For an LDAP federation provider, `connectionUrl` reports where the directory is reached, `startTls` whether the connection is upgraded to TLS, and `connectionEncrypted` whether either ldaps or StartTLS protects it. An unencrypted LDAP federation sends the bind credentials and every password it validates in the clear. Select a provider with `keycloak.realms.first.components.where(providerId == \"ldap\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"group":{"name":"group","type":"\u001bkeycloak.group","title":"Keycloak Group","desc":"A group in a realm, the roles its members inherit, and the groups nested under it. The `realmRoles` and `clientRoles` fields report the mappings as Keycloak stores them, and `roles` resolves the realm role mappings to the roles themselves so a composite can be followed. Membership of a group is what usually carries administrative access into a cluster, since a group name is what an OIDC groups claim contains.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"identityProvider":{"name":"identityProvider","type":"\u001bkeycloak.identityProvider","title":"Keycloak Identity Provider","desc":"A federated identity provider a realm accepts logins from, and how far it trusts the assertions that arrive from it. Query `enabled` for whether the provider is live, `trustEmail` for whether an email address from the provider is accepted without verification, `validateSignature` with `useJwksUrl` for whether an incoming token is checked at all, `linkOnly` for whether the provider may create accounts, and `firstBrokerLoginFlow` for what a first-time federated user runs through. A provider that skips signature validation lets anyone who can reach the callback mint an identity in the realm.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"protocolMapper":{"name":"protocolMapper","type":"\u001bkeycloak.protocolMapper","title":"Keycloak Protocol Mapper","desc":"A rule that puts a value into a token, an ID token or the userinfo response. A mapper is where a claim comes from, so it is what can leak an attribute or widen a token's audience. Query `mapperType` for what the mapper does, for example oidc-audience-mapper for one that adds an audience or oidc-usermodel-attribute-mapper for one that copies a user attribute, and `addToAccessToken` with `addToIdToken` and `addToUserInfo` for where the value lands. The `claimName` field names the claim it writes.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Keycloak Realm","desc":"A Keycloak realm and the authentication posture that applies to every client and user under it. Query `passwordPolicy` and `passwordPolicyRules` for the credential rules, `bruteForceProtected` with `failureFactor` and `permanentLockout` for lockout, `sslRequired` for transport enforcement, `registrationAllowed` and `rememberMe` for self-service exposure, and the `accessTokenLifespan` and `ssoSession*` fields for how long a session outlives a revocation. The `browserFlow` and `directGrantFlow` bindings name the authentication flows in force, which is what makes a missing multi-factor step detectable. Select a realm with `keycloak.realms.where(name == \"production\")`.","provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"realms":{"name":"realms","type":"\u0019\u001bkeycloak.realm","title":"Realms the credentials can read","provider":"go.mondoo.com/mql/providers/keycloak"},"role":{"name":"role","type":"\u001bkeycloak.role","title":"Keycloak Role","desc":"A role in a realm or on a client, and the roles it carries with it. The `composite` field reports whether the role grants other roles, and `composites` resolves them, which is how a role that looks harmless turns out to carry realm-admin. The `clientRole` field distinguishes a role defined by a client from a realm role, and `client` names that client.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"serverUrl":{"name":"serverUrl","type":"\u0007","title":"Base URL of the Keycloak server","provider":"go.mondoo.com/mql/providers/keycloak"},"user":{"name":"user","type":"\u001bkeycloak.user","title":"Keycloak User","desc":"A user of a realm, including the service account users that clients authenticate as. Query `enabled` and `emailVerified` for the account state, `requiredActions` for what the user is still asked to complete, `federationLink` for whether the account comes from an external directory, and `serviceAccountClientId` for whether it belongs to a client rather than a person. The `hasAdminRole` field reports whether the account holds a realm administration role, directly or through a composite, which is what turns a leaked client secret into full control of the realm.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true}},"title":"Keycloak","desc":"Keycloak server posture across every realm the credentials can read. The `realms` field enumerates those realms with their password policy, brute force settings, token lifespans and authentication flow bindings, and `clients` flattens every client across them so a wildcard redirect URI or a public client can be found in one query. Scope a scan to one realm with the --realm flag, or leave it unset to walk every realm the credentials reach.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.authenticationFlow":{"id":"keycloak.authenticationFlow","name":"keycloak.authenticationFlow","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Alias the flow is bound by","provider":"go.mondoo.com/mql/providers/keycloak"},"builtIn":{"name":"builtIn","type":"\u0004","is_mandatory":true,"title":"Whether Keycloak ships the flow rather than an administrator creating it","provider":"go.mondoo.com/mql/providers/keycloak"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"execution":{"name":"execution","type":"\u001bkeycloak.authenticationFlow.execution","title":"Keycloak Authentication Execution","desc":"A single step of an authentication flow. The `requirement` field decides whether the step runs, and `providerId` names what the step does, for example auth-otp-form for a one-time password prompt or auth-username- password-form for the password prompt. A step whose requirement is ALTERNATIVE can be skipped when a sibling succeeds, so a one-time password step marked ALTERNATIVE next to a password step is optional in practice.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"executions":{"name":"executions","type":"\u0019\u001bkeycloak.authenticationFlow.execution","title":"Steps of the flow in the order they run","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal flow identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Kind of flow, either basic-flow or form-flow","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the flow belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"topLevel":{"name":"topLevel","type":"\u0004","is_mandatory":true,"title":"Whether the flow can be bound to a realm binding","desc":"A flow that is not top level is a sub-flow, reached only from another flow's execution list.","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Authentication Flow","desc":"An ordered set of authentication steps a realm can bind to browser login, the direct grant, registration or credential reset. The `executions` field lists the steps with the requirement each one carries, which is what makes a missing second factor visible: a browser flow whose only credential step is a password, with no REQUIRED or CONDITIONAL one-time password step, accepts a single factor. The realm's `browserFlow` and `directGrantFlow` fields name which flows are actually in force.","private":true,"min_provider_version":"13.0.0","defaults":"alias topLevel builtIn","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.authenticationFlow.execution":{"id":"keycloak.authenticationFlow.execution","name":"keycloak.authenticationFlow.execution","fields":{"authenticationConfig":{"name":"authenticationConfig","type":"\u0007","is_mandatory":true,"title":"Identifier of the step's configuration, or an empty value when it has none","provider":"go.mondoo.com/mql/providers/keycloak"},"config":{"name":"config","type":"\u001a\u0007\u0007","title":"Settings of the step","desc":"Empty for a step that carries none. For a conditional one-time password sub-flow, this is what decides when the second factor is demanded, so a step set to skip the prompt is visible here rather than in the requirement.","provider":"go.mondoo.com/mql/providers/keycloak"},"configurable":{"name":"configurable","type":"\u0004","is_mandatory":true,"title":"Whether the step carries settings of its own","provider":"go.mondoo.com/mql/providers/keycloak"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name of the step","provider":"go.mondoo.com/mql/providers/keycloak"},"flow":{"name":"flow","type":"\u001bkeycloak.authenticationFlow","title":"Flow the step belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"flowAlias":{"name":"flowAlias","type":"\u0007","is_mandatory":true,"title":"Alias of the sub-flow this step runs, or an empty value for a leaf step","provider":"go.mondoo.com/mql/providers/keycloak"},"index":{"name":"index","type":"\u0005","is_mandatory":true,"title":"Position of the step among its siblings","provider":"go.mondoo.com/mql/providers/keycloak"},"level":{"name":"level","type":"\u0005","is_mandatory":true,"title":"Nesting depth of the step within the flow","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Authenticator that implements the step","desc":"Empty when the step is a nested sub-flow, whose alias is in flowAlias.","provider":"go.mondoo.com/mql/providers/keycloak"},"requirement":{"name":"requirement","type":"\u0007","is_mandatory":true,"title":"Whether and when the step runs","desc":"One of REQUIRED, ALTERNATIVE, CONDITIONAL or DISABLED. A REQUIRED step always runs, an ALTERNATIVE one is skipped once a sibling succeeds, a CONDITIONAL one runs only when its condition matches, and a DISABLED one never runs.","provider":"go.mondoo.com/mql/providers/keycloak"},"requirementChoices":{"name":"requirementChoices","type":"\u0019\u0007","is_mandatory":true,"title":"Requirements the step could be set to","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Authentication Execution","desc":"A single step of an authentication flow. The `requirement` field decides whether the step runs, and `providerId` names what the step does, for example auth-otp-form for a one-time password prompt or auth-username- password-form for the password prompt. A step whose requirement is ALTERNATIVE can be skipped when a sibling succeeds, so a one-time password step marked ALTERNATIVE next to a password step is optional in practice.","private":true,"min_provider_version":"13.0.0","defaults":"displayName requirement level","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.client":{"id":"keycloak.client","name":"keycloak.client","fields":{"adminUrl":{"name":"adminUrl","type":"\u0007","is_mandatory":true,"title":"URL Keycloak calls to push revocation and logout","provider":"go.mondoo.com/mql/providers/keycloak"},"attributes":{"name":"attributes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Client-specific settings that are not modeled as fields","desc":"Keyed by the attribute name Keycloak stores, such as `post.logout.redirect.uris`, `access.token.lifespan` or `oauth2.device.authorization.grant.enabled`.","provider":"go.mondoo.com/mql/providers/keycloak"},"authenticationFlowBindingOverrides":{"name":"authenticationFlowBindingOverrides","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Authentication flows this client runs instead of the realm's","desc":"Keyed by binding name, either browser or direct_grant, with the identifier of the flow the client uses. An override replaces the realm's flow for this client alone, so a second factor the realm requires does not apply to it.","provider":"go.mondoo.com/mql/providers/keycloak"},"authorizationServicesEnabled":{"name":"authorizationServicesEnabled","type":"\u0004","is_mandatory":true,"title":"Whether fine-grained authorization services are enabled","provider":"go.mondoo.com/mql/providers/keycloak"},"authorizationSettings":{"name":"authorizationSettings","type":"\u001bkeycloak.client.authorizationSettings","title":"Fine-grained authorization settings of the client","desc":"Null unless authorizationServicesEnabled is true. It reports how the client decides a request that no policy covers.","provider":"go.mondoo.com/mql/providers/keycloak"},"baseUrl":{"name":"baseUrl","type":"\u0007","is_mandatory":true,"title":"Home URL of the application","provider":"go.mondoo.com/mql/providers/keycloak"},"bearerOnly":{"name":"bearerOnly","type":"\u0004","is_mandatory":true,"title":"Whether the client only validates tokens and never obtains them","provider":"go.mondoo.com/mql/providers/keycloak"},"clientAuthenticatorType":{"name":"clientAuthenticatorType","type":"\u0007","is_mandatory":true,"title":"Method the client authenticates itself with","desc":"One of client-secret, client-secret-jwt, client-jwt or client-x509. A shared secret is replayable if it leaks, which the private key methods are not.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Client identifier used in OAuth requests","provider":"go.mondoo.com/mql/providers/keycloak"},"consentRequired":{"name":"consentRequired","type":"\u0004","is_mandatory":true,"title":"Whether the user is asked to approve the scopes before they are released","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultClientScopes":{"name":"defaultClientScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the scopes every token for this client carries","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultScopes":{"name":"defaultScopes","type":"\u0019\u001bkeycloak.clientScope","title":"Scopes every token for this client carries","desc":"Their protocol mappers decide what a token issued to this client contains without the request asking for anything.","provider":"go.mondoo.com/mql/providers/keycloak"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"directAccessGrantsEnabled":{"name":"directAccessGrantsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the direct access grant is enabled","desc":"The direct access grant exchanges a user name and password for a token without a browser, which bypasses any step the browser flow adds, such as a second factor.","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the client may be used","provider":"go.mondoo.com/mql/providers/keycloak"},"frontchannelLogout":{"name":"frontchannelLogout","type":"\u0004","is_mandatory":true,"title":"Whether Keycloak notifies the client of a logout through the browser","provider":"go.mondoo.com/mql/providers/keycloak"},"fullScopeAllowed":{"name":"fullScopeAllowed","type":"\u0004","is_mandatory":true,"title":"Whether the client's tokens carry every role of the user","desc":"With a full scope, a token issued to one application carries the roles that belong to every other, so a compromised client's token reaches further than the client itself does.","provider":"go.mondoo.com/mql/providers/keycloak"},"hasWildcardRedirectUri":{"name":"hasWildcardRedirectUri","type":"\u0004","is_mandatory":true,"title":"Whether any redirect URI contains a wildcard","desc":"A wildcard widens where an authorization code may be delivered. Combined with a public client it lets an attacker who controls a matching URL collect codes for any user who signs in, which is a full authentication bypass. The matching entries are in wildcardRedirectUris.","provider":"go.mondoo.com/mql/providers/keycloak"},"hasWildcardWebOrigin":{"name":"hasWildcardWebOrigin","type":"\u0004","is_mandatory":true,"title":"Whether any web origin is the wildcard `*`","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal client identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"implicitFlowEnabled":{"name":"implicitFlowEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the implicit flow is enabled","desc":"The implicit flow returns a token in the browser URL, where it reaches the history, the referrer header and any proxy log on the way. It is deprecated by the OAuth 2.0 security best practice.","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/keycloak"},"optionalClientScopes":{"name":"optionalClientScopes","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the scopes a request for this client may ask for","provider":"go.mondoo.com/mql/providers/keycloak"},"optionalScopes":{"name":"optionalScopes","type":"\u0019\u001bkeycloak.clientScope","title":"Scopes a request for this client may ask for","provider":"go.mondoo.com/mql/providers/keycloak"},"pkceCodeChallengeMethod":{"name":"pkceCodeChallengeMethod","type":"\u0007","is_mandatory":true,"title":"Proof key method the client must use for the code exchange","desc":"Either S256, plain or an empty value when no method is required. Without a method, an intercepted authorization code can be redeemed by whoever holds it.","provider":"go.mondoo.com/mql/providers/keycloak"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol the client speaks, either openid-connect or saml","provider":"go.mondoo.com/mql/providers/keycloak"},"protocolMappers":{"name":"protocolMappers","type":"\u0019\u001bkeycloak.protocolMapper","title":"Protocol mappers defined on the client itself","desc":"These run in addition to the mappers of the client's scopes, so a claim can be added here even when every scope is a stock one.","provider":"go.mondoo.com/mql/providers/keycloak"},"publicClient":{"name":"publicClient","type":"\u0004","is_mandatory":true,"title":"Whether the client authenticates without a secret","desc":"A public client proves nothing about its identity, so every control that guards an authorization code rests on the redirect URI and on PKCE.","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the client is registered in","provider":"go.mondoo.com/mql/providers/keycloak"},"redirectUris":{"name":"redirectUris","type":"\u0019\u0007","is_mandatory":true,"title":"Redirect targets an authorization code or token may be sent to","desc":"Each entry is an absolute URL or a pattern. Keycloak accepts a trailing * as a wildcard, so an entry such as `https://app.example.com/*` matches every path under the host, and an entry of `*` matches any URL at all.","provider":"go.mondoo.com/mql/providers/keycloak"},"roles":{"name":"roles","type":"\u0019\u001bkeycloak.role","title":"Roles defined by the client","provider":"go.mondoo.com/mql/providers/keycloak"},"rootUrl":{"name":"rootUrl","type":"\u0007","is_mandatory":true,"title":"Root URL that relative redirect URIs resolve against","provider":"go.mondoo.com/mql/providers/keycloak"},"scopeMappings":{"name":"scopeMappings","type":"\u0019\u001bkeycloak.role","title":"Roles a token for this client may carry when the full scope is off","desc":"Empty when fullScopeAllowed is true, since the token then carries every role the user holds. Otherwise these are the only roles that reach the token, which is what bounds a compromised client.","provider":"go.mondoo.com/mql/providers/keycloak"},"serviceAccountUser":{"name":"serviceAccountUser","type":"\u001bkeycloak.user","title":"User the client authenticates as when it uses its service account","provider":"go.mondoo.com/mql/providers/keycloak"},"serviceAccountsEnabled":{"name":"serviceAccountsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the client holds a service account","desc":"A service account is a user in the realm that the client authenticates as. Its role mappings are in serviceAccountUser.","provider":"go.mondoo.com/mql/providers/keycloak"},"standardFlowEnabled":{"name":"standardFlowEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the authorization code flow is enabled","provider":"go.mondoo.com/mql/providers/keycloak"},"webOrigins":{"name":"webOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"Origins allowed to call the realm from a browser","desc":"An entry of `*` allows any origin. Keycloak also accepts `+`, which stands for the origins derived from the redirect URIs.","provider":"go.mondoo.com/mql/providers/keycloak"},"wildcardRedirectUris":{"name":"wildcardRedirectUris","type":"\u0019\u0007","is_mandatory":true,"title":"Redirect URIs that contain a wildcard","provider":"go.mondoo.com/mql/providers/keycloak"}},"init":{"args":[{"name":"clientId","type":"\u0007"}]},"title":"Keycloak Client","desc":"An application or service registered with a realm, and the OAuth flows and redirect targets it is trusted with. Query `publicClient` for whether the client authenticates itself at all, `redirectUris` together with `hasWildcardRedirectUri` for where an authorization code may be sent, `webOrigins` with `hasWildcardWebOrigin` for cross-origin access, `standardFlowEnabled`, `implicitFlowEnabled`, `directAccessGrantsEnabled` and `serviceAccountsEnabled` for which grants it may use, `consentRequired` for whether a user is asked before scopes are released, and `pkceCodeChallengeMethod` for whether the code exchange is bound to the requesting client. A public client with a wildcard redirect URI lets an attacker collect authorization codes for any user of the realm. Select a client with `keycloak.clients.where(clientId == \"kubernetes\")`.","min_provider_version":"13.0.0","defaults":"clientId enabled publicClient","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.client.authorizationSettings":{"id":"keycloak.client.authorizationSettings","name":"keycloak.client.authorizationSettings","fields":{"allowRemoteResourceManagement":{"name":"allowRemoteResourceManagement","type":"\u0004","is_mandatory":true,"title":"Whether a client may manage its own resources through the protection API","provider":"go.mondoo.com/mql/providers/keycloak"},"client":{"name":"client","type":"\u001bkeycloak.client","title":"Client the settings belong to","provider":"go.mondoo.com/mql/providers/keycloak"},"decisionStrategy":{"name":"decisionStrategy","type":"\u0007","is_mandatory":true,"title":"How several matching policies combine","desc":"Either UNANIMOUS, which requires every policy to allow, or AFFIRMATIVE, which allows when any one of them does.","provider":"go.mondoo.com/mql/providers/keycloak"},"policyEnforcementMode":{"name":"policyEnforcementMode","type":"\u0007","is_mandatory":true,"title":"How a request that no policy covers is decided","desc":"One of ENFORCING, PERMISSIVE or DISABLED. With ENFORCING, such a request is denied. With PERMISSIVE, it is allowed. With DISABLED, authorization is not evaluated at all.","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Client Authorization Settings","desc":"The fine-grained authorization server a client can turn on, and how it decides a request. The `policyEnforcementMode` field is the one that carries risk: with PERMISSIVE, a request for a resource that no policy covers is allowed, so adding a resource without a policy grants it to everyone. The `decisionStrategy` field decides how several matching policies combine.","private":true,"min_provider_version":"13.0.0","defaults":"policyEnforcementMode decisionStrategy","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.clientPolicy":{"id":"keycloak.clientPolicy","name":"keycloak.clientPolicy","fields":{"conditionTypes":{"name":"conditionTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Conditions that decide which clients the policy applies to","desc":"Each entry names a condition, for example client-access-type, client-updater-context or any-client.","provider":"go.mondoo.com/mql/providers/keycloak"},"conditions":{"name":"conditions","type":"\n","is_mandatory":true,"title":"Full condition configuration as Keycloak stores it","provider":"go.mondoo.com/mql/providers/keycloak"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the policy is in force","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Policy name","provider":"go.mondoo.com/mql/providers/keycloak"},"profiles":{"name":"profiles","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the client profiles the policy applies","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the policy is defined in","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Client Policy","desc":"A rule that applies client profiles to the clients its conditions match. The `enabled` field decides whether it is in force at all, `profiles` names the profiles it applies, and `conditionTypes` reports what it matches on. A policy that is disabled, or that names no profile, enforces nothing.","private":true,"min_provider_version":"13.0.0","defaults":"name enabled","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.clientProfile":{"id":"keycloak.clientProfile","name":"keycloak.clientProfile","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"executorTypes":{"name":"executorTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Requirements the profile applies","desc":"Each entry names an executor, for example secure-client-authenticator, pkce-enforcer or confidential-client-acceptable.","provider":"go.mondoo.com/mql/providers/keycloak"},"executors":{"name":"executors","type":"\n","is_mandatory":true,"title":"Full executor configuration as Keycloak stores it","provider":"go.mondoo.com/mql/providers/keycloak"},"isBuiltIn":{"name":"isBuiltIn","type":"\u0004","is_mandatory":true,"title":"Whether Keycloak ships the profile rather than an administrator creating it","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile name","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the profile is defined in","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Client Profile","desc":"A named set of requirements a client must meet, called executors, such as demanding a proof key or refusing a public client. A profile is inert until a client policy applies it, so `keycloak.realm.clientPolicies` is what says whether it is in force. Query `executorTypes` for what the profile demands.","private":true,"min_provider_version":"13.0.0","defaults":"name isBuiltIn","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.clientScope":{"id":"keycloak.clientScope","name":"keycloak.clientScope","fields":{"attributes":{"name":"attributes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Full scope configuration as Keycloak stores it","desc":"Keyed by the attribute name, such as `include.in.token.scope` or `display.on.consent.screen`. The settings that carry security meaning are modeled as fields.","provider":"go.mondoo.com/mql/providers/keycloak"},"consentScreenText":{"name":"consentScreenText","type":"\u0007","is_mandatory":true,"title":"Text shown for the scope on the consent screen","provider":"go.mondoo.com/mql/providers/keycloak"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"displayOnConsentScreen":{"name":"displayOnConsentScreen","type":"\u0004","is_mandatory":true,"title":"Whether the scope is shown on the consent screen","provider":"go.mondoo.com/mql/providers/keycloak"},"guiOrder":{"name":"guiOrder","type":"\u0007","is_mandatory":true,"title":"Order the scope is shown in on the user interface","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal scope identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"includeInTokenScope":{"name":"includeInTokenScope","type":"\u0004","is_mandatory":true,"title":"Whether the scope name is listed in the token's scope claim","provider":"go.mondoo.com/mql/providers/keycloak"},"isRealmDefault":{"name":"isRealmDefault","type":"\u0004","is_mandatory":true,"title":"Whether the realm attaches the scope to every new client by default","desc":"A default scope reaches clients that never asked for it, so a mapper added to one is applied realm-wide.","provider":"go.mondoo.com/mql/providers/keycloak"},"isRealmOptional":{"name":"isRealmOptional","type":"\u0004","is_mandatory":true,"title":"Whether the realm offers the scope to every new client as optional","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Scope name, which is what a client asks for","provider":"go.mondoo.com/mql/providers/keycloak"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol the scope applies to, either openid-connect or saml","provider":"go.mondoo.com/mql/providers/keycloak"},"protocolMappers":{"name":"protocolMappers","type":"\u0019\u001bkeycloak.protocolMapper","title":"Protocol mappers the scope applies to a token","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the scope is defined in","provider":"go.mondoo.com/mql/providers/keycloak"},"scopeMappings":{"name":"scopeMappings","type":"\u0019\u001bkeycloak.role","title":"Roles the scope lets through into a token","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Client Scope","desc":"A named set of protocol mappers and role scope mappings that a client can attach to its tokens. A scope in a client's default list is applied to every token without the request asking for it, so a mapper added here reaches every client that carries the scope. Query `protocolMappers` for what the scope puts into a token, `includeInTokenScope` for whether the scope name appears in the token's scope claim, and `scopeMappings` for the roles it lets through. Select a scope with `keycloak.realms.first.clientScopes.where(name == \"profile\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name protocol","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.component":{"id":"keycloak.component","name":"keycloak.component","fields":{"authType":{"name":"authType","type":"\u0007","is_mandatory":true,"title":"How the realm authenticates to the directory, either simple or none","provider":"go.mondoo.com/mql/providers/keycloak"},"bindDn":{"name":"bindDn","type":"\u0007","is_mandatory":true,"title":"Distinguished name the realm binds to the directory as","provider":"go.mondoo.com/mql/providers/keycloak"},"config":{"name":"config","type":"\n","is_mandatory":true,"title":"Full component configuration as Keycloak stores it","desc":"Keyed by the setting name, with a list of values, since Keycloak stores every component setting as a list even when it holds one value.","provider":"go.mondoo.com/mql/providers/keycloak"},"connectionEncrypted":{"name":"connectionEncrypted","type":"\u0004","is_mandatory":true,"title":"Whether the directory connection is protected, by ldaps or by StartTLS","desc":"When false, the bind credentials and every password the realm validates against the directory cross the network in the clear.","provider":"go.mondoo.com/mql/providers/keycloak"},"connectionUrl":{"name":"connectionUrl","type":"\u0007","is_mandatory":true,"title":"URL of the federated directory","desc":"Empty for a component that is not a directory federation. An ldap:// URL is plaintext unless startTls upgrades it.","provider":"go.mondoo.com/mql/providers/keycloak"},"editMode":{"name":"editMode","type":"\u0007","is_mandatory":true,"title":"Whether the realm may write back to the directory","desc":"One of READ_ONLY, WRITABLE or UNSYNCED. With UNSYNCED, a password changed in Keycloak is kept locally and the directory's copy stays as it was.","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal component identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"isUserFederation":{"name":"isUserFederation","type":"\u0004","is_mandatory":true,"title":"Whether the component is a user federation provider","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Component name","provider":"go.mondoo.com/mql/providers/keycloak"},"parentId":{"name":"parentId","type":"\u0007","is_mandatory":true,"title":"Identifier of the realm or component this one is nested under","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Kind of component, such as ldap, kerberos, rsa-generated or hmac-generated","provider":"go.mondoo.com/mql/providers/keycloak"},"providerType":{"name":"providerType","type":"\u0007","is_mandatory":true,"title":"Interface the component implements","desc":"A user federation provider reports org.keycloak.storage.UserStorageProvider, and a key provider reports org.keycloak.keys.KeyProvider.","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the component belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"startTls":{"name":"startTls","type":"\u0004","is_mandatory":true,"title":"Whether the directory connection is upgraded to TLS after it opens","provider":"go.mondoo.com/mql/providers/keycloak"},"subType":{"name":"subType","type":"\u0007","is_mandatory":true,"title":"Narrower kind within the provider type","provider":"go.mondoo.com/mql/providers/keycloak"},"trustEmail":{"name":"trustEmail","type":"\u0004","is_mandatory":true,"title":"Whether an email address from the directory is accepted as verified","provider":"go.mondoo.com/mql/providers/keycloak"},"useTruststoreSpi":{"name":"useTruststoreSpi","type":"\u0007","is_mandatory":true,"title":"How the realm's truststore is used for the connection","desc":"One of always, never or ldapsOnly. With never, the directory's certificate is not checked, so the encrypted connection can be intercepted.","provider":"go.mondoo.com/mql/providers/keycloak"},"usersDn":{"name":"usersDn","type":"\u0007","is_mandatory":true,"title":"Distinguished name users are searched under","provider":"go.mondoo.com/mql/providers/keycloak"},"validatePasswordPolicy":{"name":"validatePasswordPolicy","type":"\u0004","is_mandatory":true,"title":"Whether a password from the directory is checked against the realm's policy","provider":"go.mondoo.com/mql/providers/keycloak"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Directory product the provider expects, such as ad, rhds or other","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Component","desc":"A pluggable component of a realm, most often a user federation provider or a key provider. For an LDAP federation provider, `connectionUrl` reports where the directory is reached, `startTls` whether the connection is upgraded to TLS, and `connectionEncrypted` whether either ldaps or StartTLS protects it. An unencrypted LDAP federation sends the bind credentials and every password it validates in the clear. Select a provider with `keycloak.realms.first.components.where(providerId == \"ldap\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name providerId providerType","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.group":{"id":"keycloak.group","name":"keycloak.group","fields":{"allRoles":{"name":"allRoles","type":"\u0019\u001bkeycloak.role","title":"Every role the group grants, realm and client alike","provider":"go.mondoo.com/mql/providers/keycloak"},"attributes":{"name":"attributes","type":"\n","is_mandatory":true,"title":"Custom attributes attached to the group","desc":"Keyed by the attribute name, with a list of values, since Keycloak stores every group attribute as a list even when it holds one value.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientRoleMappings":{"name":"clientRoleMappings","type":"\u0019\u001bkeycloak.role","title":"Client roles the group grants","desc":"A client role is as capable as a realm role, and the realm-management ones administer the realm, so a group that grants them makes every member an administrator.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientRoles":{"name":"clientRoles","type":"\n","is_mandatory":true,"title":"Names of the client roles the group grants","desc":"Keyed by the client identifier, with the list of role names that client grants. Use clientRoleMappings for the same roles as resolved resources.","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal group identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Group name","provider":"go.mondoo.com/mql/providers/keycloak"},"path":{"name":"path","type":"\u0007","is_mandatory":true,"title":"Full path of the group, including its parents","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the group belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"realmRoles":{"name":"realmRoles","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the realm roles the group grants","provider":"go.mondoo.com/mql/providers/keycloak"},"roles":{"name":"roles","type":"\u0019\u001bkeycloak.role","title":"Realm roles the group grants","provider":"go.mondoo.com/mql/providers/keycloak"},"subGroupCount":{"name":"subGroupCount","type":"\u0005","is_mandatory":true,"title":"Number of groups nested directly under this one","provider":"go.mondoo.com/mql/providers/keycloak"},"subGroups":{"name":"subGroups","type":"\u0019\u001bkeycloak.group","title":"Groups nested under this one","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Group","desc":"A group in a realm, the roles its members inherit, and the groups nested under it. The `realmRoles` and `clientRoles` fields report the mappings as Keycloak stores them, and `roles` resolves the realm role mappings to the roles themselves so a composite can be followed. Membership of a group is what usually carries administrative access into a cluster, since a group name is what an OIDC groups claim contains.","private":true,"min_provider_version":"13.0.0","defaults":"path name","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.identityProvider":{"id":"keycloak.identityProvider","name":"keycloak.identityProvider","fields":{"addReadTokenRoleOnCreate":{"name":"addReadTokenRoleOnCreate","type":"\u0004","is_mandatory":true,"title":"Whether users may read the stored token","provider":"go.mondoo.com/mql/providers/keycloak"},"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Alias the provider is addressed by, which appears in its callback URL","provider":"go.mondoo.com/mql/providers/keycloak"},"authorizationUrl":{"name":"authorizationUrl","type":"\u0007","is_mandatory":true,"title":"Authorization endpoint of the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"clientAuthMethod":{"name":"clientAuthMethod","type":"\u0007","is_mandatory":true,"title":"How the realm authenticates at the provider's token endpoint","provider":"go.mondoo.com/mql/providers/keycloak"},"clientId":{"name":"clientId","type":"\u0007","is_mandatory":true,"title":"Client identifier the realm uses at the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"config":{"name":"config","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Full provider configuration as Keycloak stores it","desc":"Keyed by the setting name, with the value as a string. Every value Keycloak stores here is a string, so a boolean setting reads as \"true\" or \"false\". The settings that carry security meaning are modeled as fields.","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultScope":{"name":"defaultScope","type":"\u0007","is_mandatory":true,"title":"Scopes the realm requests from the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name shown on the login page","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the provider accepts logins","provider":"go.mondoo.com/mql/providers/keycloak"},"firstBrokerLoginFlow":{"name":"firstBrokerLoginFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow a first-time federated user runs","provider":"go.mondoo.com/mql/providers/keycloak"},"firstBrokerLoginFlowRef":{"name":"firstBrokerLoginFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow a first-time federated user runs","provider":"go.mondoo.com/mql/providers/keycloak"},"hideOnLoginPage":{"name":"hideOnLoginPage","type":"\u0004","is_mandatory":true,"title":"Whether the provider is skipped on the login page unless it is requested","provider":"go.mondoo.com/mql/providers/keycloak"},"internalId":{"name":"internalId","type":"\u0007","is_mandatory":true,"title":"Internal identifier of the provider instance","provider":"go.mondoo.com/mql/providers/keycloak"},"issuer":{"name":"issuer","type":"\u0007","is_mandatory":true,"title":"Expected issuer of an incoming token","provider":"go.mondoo.com/mql/providers/keycloak"},"jwksUrl":{"name":"jwksUrl","type":"\u0007","is_mandatory":true,"title":"JWKS endpoint the signing keys are read from","provider":"go.mondoo.com/mql/providers/keycloak"},"linkOnly":{"name":"linkOnly","type":"\u0004","is_mandatory":true,"title":"Whether the provider may only link to existing accounts","desc":"When false, a first login through the provider creates a new account in the realm.","provider":"go.mondoo.com/mql/providers/keycloak"},"pkceEnabled":{"name":"pkceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the realm uses PKCE when it redirects to the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"postBrokerLoginFlow":{"name":"postBrokerLoginFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow run after every login through the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"postBrokerLoginFlowRef":{"name":"postBrokerLoginFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow run after every login through the provider","desc":"Null when the provider binds no flow, which is the default. A bound flow is what can add a step, such as a second factor, to every federated login.","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Kind of provider, such as oidc, saml, github or google","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the provider is configured for","provider":"go.mondoo.com/mql/providers/keycloak"},"storeToken":{"name":"storeToken","type":"\u0004","is_mandatory":true,"title":"Whether tokens issued by the provider are stored with the account","provider":"go.mondoo.com/mql/providers/keycloak"},"syncMode":{"name":"syncMode","type":"\u0007","is_mandatory":true,"title":"How account data is refreshed from the provider","desc":"One of LEGACY, IMPORT or FORCE. With IMPORT, the account keeps the values it was created with, so a change at the provider does not reach the realm.","provider":"go.mondoo.com/mql/providers/keycloak"},"tokenUrl":{"name":"tokenUrl","type":"\u0007","is_mandatory":true,"title":"Token endpoint of the provider","provider":"go.mondoo.com/mql/providers/keycloak"},"trustEmail":{"name":"trustEmail","type":"\u0004","is_mandatory":true,"title":"Whether an email address from the provider is accepted as verified","desc":"With trust, a provider that lets a user set an unverified email address can take over a Keycloak account that carries the same address.","provider":"go.mondoo.com/mql/providers/keycloak"},"useJwksUrl":{"name":"useJwksUrl","type":"\u0004","is_mandatory":true,"title":"Whether signing keys are fetched from the provider's JWKS endpoint","desc":"Without it, verification rests on a key pasted into the configuration, which does not follow a key rotation at the provider.","provider":"go.mondoo.com/mql/providers/keycloak"},"validateSignature":{"name":"validateSignature","type":"\u0004","is_mandatory":true,"title":"Whether the signature of an incoming assertion is verified","desc":"Without verification, an assertion is accepted on the strength of its contents alone, so anyone who can post to the callback can claim any identity.","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Identity Provider","desc":"A federated identity provider a realm accepts logins from, and how far it trusts the assertions that arrive from it. Query `enabled` for whether the provider is live, `trustEmail` for whether an email address from the provider is accepted without verification, `validateSignature` with `useJwksUrl` for whether an incoming token is checked at all, `linkOnly` for whether the provider may create accounts, and `firstBrokerLoginFlow` for what a first-time federated user runs through. A provider that skips signature validation lets anyone who can reach the callback mint an identity in the realm.","private":true,"min_provider_version":"13.0.0","defaults":"alias providerId enabled","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.protocolMapper":{"id":"keycloak.protocolMapper","name":"keycloak.protocolMapper","fields":{"addToAccessToken":{"name":"addToAccessToken","type":"\u0004","is_mandatory":true,"title":"Whether the value is added to the access token","provider":"go.mondoo.com/mql/providers/keycloak"},"addToIdToken":{"name":"addToIdToken","type":"\u0004","is_mandatory":true,"title":"Whether the value is added to the ID token","provider":"go.mondoo.com/mql/providers/keycloak"},"addToIntrospection":{"name":"addToIntrospection","type":"\u0004","is_mandatory":true,"title":"Whether the value is added to the token introspection response","provider":"go.mondoo.com/mql/providers/keycloak"},"addToUserInfo":{"name":"addToUserInfo","type":"\u0004","is_mandatory":true,"title":"Whether the value is returned from the userinfo endpoint","provider":"go.mondoo.com/mql/providers/keycloak"},"claimName":{"name":"claimName","type":"\u0007","is_mandatory":true,"title":"Name of the claim the mapper writes","desc":"Empty for a mapper that writes no named claim, such as one that only adds an audience.","provider":"go.mondoo.com/mql/providers/keycloak"},"config":{"name":"config","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Full mapper configuration as Keycloak stores it","desc":"Keyed by the setting name, with the value as a string. Every value Keycloak stores here is a string, so a boolean setting reads as \"true\" or \"false\". The settings that carry security meaning are modeled as fields.","provider":"go.mondoo.com/mql/providers/keycloak"},"fullPath":{"name":"fullPath","type":"\u0004","is_mandatory":true,"title":"Whether the claim carries the user's full group path","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal mapper identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"includedClientAudience":{"name":"includedClientAudience","type":"\u0007","is_mandatory":true,"title":"Audience the mapper adds to the token","desc":"Set by an audience mapper, and empty otherwise. An audience naming another client lets a token issued for this client be accepted by that one.","provider":"go.mondoo.com/mql/providers/keycloak"},"includedCustomAudience":{"name":"includedCustomAudience","type":"\u0007","is_mandatory":true,"title":"Custom audience the mapper adds to the token","provider":"go.mondoo.com/mql/providers/keycloak"},"mapperType":{"name":"mapperType","type":"\u0007","is_mandatory":true,"title":"Kind of mapper","desc":"For example oidc-usermodel-attribute-mapper, oidc-audience-mapper, oidc-group-membership-mapper or oidc-hardcoded-claim-mapper. The kind decides what the mapper reads and therefore what it can expose.","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Mapper name","provider":"go.mondoo.com/mql/providers/keycloak"},"protocol":{"name":"protocol","type":"\u0007","is_mandatory":true,"title":"Protocol the mapper applies to, either openid-connect or saml","provider":"go.mondoo.com/mql/providers/keycloak"},"userAttribute":{"name":"userAttribute","type":"\u0007","is_mandatory":true,"title":"User attribute the mapper reads","desc":"Set by a mapper that copies a user attribute or property into a claim, and empty otherwise.","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Protocol Mapper","desc":"A rule that puts a value into a token, an ID token or the userinfo response. A mapper is where a claim comes from, so it is what can leak an attribute or widen a token's audience. Query `mapperType` for what the mapper does, for example oidc-audience-mapper for one that adds an audience or oidc-usermodel-attribute-mapper for one that copies a user attribute, and `addToAccessToken` with `addToIdToken` and `addToUserInfo` for where the value lands. The `claimName` field names the claim it writes.","private":true,"min_provider_version":"13.0.0","defaults":"name mapperType claimName","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.realm":{"id":"keycloak.realm","name":"keycloak.realm","fields":{"accessCodeLifespan":{"name":"accessCodeLifespan","type":"\u0005","is_mandatory":true,"title":"Seconds an authorization code stays redeemable","provider":"go.mondoo.com/mql/providers/keycloak"},"accessCodeLifespanLogin":{"name":"accessCodeLifespanLogin","type":"\u0005","is_mandatory":true,"title":"Seconds a login form stays valid before it must be reloaded","provider":"go.mondoo.com/mql/providers/keycloak"},"accessCodeLifespanUserAction":{"name":"accessCodeLifespanUserAction","type":"\u0005","is_mandatory":true,"title":"Seconds a required action token stays valid","provider":"go.mondoo.com/mql/providers/keycloak"},"accessTokenLifespan":{"name":"accessTokenLifespan","type":"\u0005","is_mandatory":true,"title":"Seconds an access token stays valid","provider":"go.mondoo.com/mql/providers/keycloak"},"accessTokenLifespanForImplicitFlow":{"name":"accessTokenLifespanForImplicitFlow","type":"\u0005","is_mandatory":true,"title":"Seconds an access token issued through the implicit flow stays valid","provider":"go.mondoo.com/mql/providers/keycloak"},"actionTokenGeneratedByUserLifespan":{"name":"actionTokenGeneratedByUserLifespan","type":"\u0005","is_mandatory":true,"title":"Seconds a token generated by a user action, such as a password reset, stays valid","provider":"go.mondoo.com/mql/providers/keycloak"},"adminEventsDetailsEnabled":{"name":"adminEventsDetailsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether administrative events record the full request body","provider":"go.mondoo.com/mql/providers/keycloak"},"adminEventsEnabled":{"name":"adminEventsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether administrative changes are recorded","desc":"Without admin events, a change to a client's redirect URIs or to a role mapping leaves no trace that an audit can read back.","provider":"go.mondoo.com/mql/providers/keycloak"},"authenticationFlows":{"name":"authenticationFlows","type":"\u0019\u001bkeycloak.authenticationFlow","title":"Authentication flows defined in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"browserFlow":{"name":"browserFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used for browser login","desc":"The flow named here decides whether a browser login can require a second factor. Its steps are in browserFlowRef.","provider":"go.mondoo.com/mql/providers/keycloak"},"browserFlowRef":{"name":"browserFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to browser login","provider":"go.mondoo.com/mql/providers/keycloak"},"browserSecurityHeaders":{"name":"browserSecurityHeaders","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Security headers the realm adds to browser responses","desc":"Keyed by header name, such as contentSecurityPolicy, xFrameOptions or strictTransportSecurity, with the configured value. An empty value means the header is not sent.","provider":"go.mondoo.com/mql/providers/keycloak"},"bruteForceProtected":{"name":"bruteForceProtected","type":"\u0004","is_mandatory":true,"title":"Whether repeated failed logins lock the account","desc":"When false, an account is open to unlimited password guessing regardless of the password policy.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientAuthenticationFlow":{"name":"clientAuthenticationFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used to authenticate a client","provider":"go.mondoo.com/mql/providers/keycloak"},"clientAuthenticationFlowRef":{"name":"clientAuthenticationFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to client authentication","provider":"go.mondoo.com/mql/providers/keycloak"},"clientPolicies":{"name":"clientPolicies","type":"\u0019\u001bkeycloak.clientPolicy","title":"Client policies the realm defines","provider":"go.mondoo.com/mql/providers/keycloak"},"clientProfiles":{"name":"clientProfiles","type":"\u0019\u001bkeycloak.clientProfile","title":"Client profiles the realm defines","desc":"A profile is a set of requirements, such as demanding PKCE or a confidential client. It only takes effect where a client policy applies it.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientScopes":{"name":"clientScopes","type":"\u0019\u001bkeycloak.clientScope","title":"Client scopes defined in the realm","desc":"The scopes named in defaultDefaultClientScopes are attached to every new client, so a mapper on one of those reaches the whole realm.","provider":"go.mondoo.com/mql/providers/keycloak"},"clients":{"name":"clients","type":"\u0019\u001bkeycloak.client","title":"Clients registered in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"components":{"name":"components","type":"\u0019\u001bkeycloak.component","title":"Components configured for the realm, including user federation providers","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultDefaultClientScopes":{"name":"defaultDefaultClientScopes","type":"\u0019\u0007","title":"Names of the scopes attached to every new client by default","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultGroups":{"name":"defaultGroups","type":"\u0019\u0007","is_mandatory":true,"title":"Groups every new user joins","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultOptionalClientScopes":{"name":"defaultOptionalClientScopes","type":"\u0019\u0007","title":"Names of the scopes offered to every new client as optional","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultRole":{"name":"defaultRole","type":"\u001bkeycloak.role","title":"Composite role every new user receives, or null when the realm has none","desc":"Its composites are what a self-registered account holds from the start, which matters most when registrationAllowed is true.","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultSignatureAlgorithm":{"name":"defaultSignatureAlgorithm","type":"\u0007","is_mandatory":true,"title":"Signature algorithm tokens are signed with by default, such as RS256","provider":"go.mondoo.com/mql/providers/keycloak"},"directGrantFlow":{"name":"directGrantFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used for the direct access grant","desc":"The direct grant exchanges a user name and password for a token without a browser, so a second factor configured only in the browser flow does not apply to it.","provider":"go.mondoo.com/mql/providers/keycloak"},"directGrantFlowRef":{"name":"directGrantFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to the direct access grant","provider":"go.mondoo.com/mql/providers/keycloak"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Display name shown on the login page","provider":"go.mondoo.com/mql/providers/keycloak"},"dockerAuthenticationFlow":{"name":"dockerAuthenticationFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used for Docker registry authentication","provider":"go.mondoo.com/mql/providers/keycloak"},"dockerAuthenticationFlowRef":{"name":"dockerAuthenticationFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to Docker registry authentication","provider":"go.mondoo.com/mql/providers/keycloak"},"duplicateEmailsAllowed":{"name":"duplicateEmailsAllowed","type":"\u0004","is_mandatory":true,"title":"Whether two accounts may hold the same email address","provider":"go.mondoo.com/mql/providers/keycloak"},"editUsernameAllowed":{"name":"editUsernameAllowed","type":"\u0004","is_mandatory":true,"title":"Whether users may change their own user name","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the realm accepts authentication","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsConfig":{"name":"eventsConfig","type":"\u001bkeycloak.realm.eventsConfig","title":"Event recording configuration of the realm","desc":"The realm fields eventsEnabled and adminEventsEnabled report whether recording is on. This reports which event types are kept and where they are sent, which is what decides whether an audit can read a change back.","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsEnabled":{"name":"eventsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether login events are recorded","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsExpiration":{"name":"eventsExpiration","type":"\u0005","is_mandatory":true,"title":"Seconds a login event is kept, or 0 when events never expire","provider":"go.mondoo.com/mql/providers/keycloak"},"failureFactor":{"name":"failureFactor","type":"\u0005","is_mandatory":true,"title":"Number of failed logins that trigger a lockout","provider":"go.mondoo.com/mql/providers/keycloak"},"firstBrokerLoginFlow":{"name":"firstBrokerLoginFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow a federated user runs on first login","provider":"go.mondoo.com/mql/providers/keycloak"},"groups":{"name":"groups","type":"\u0019\u001bkeycloak.group","title":"Groups defined in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal realm identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"identityProviders":{"name":"identityProviders","type":"\u0019\u001bkeycloak.identityProvider","title":"Federated identity providers configured for the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"key":{"name":"key","type":"\u001bkeycloak.realm.key","title":"Keycloak Realm Signing Key","desc":"A cryptographic key the realm holds for signing or encrypting tokens. The `status` field reports whether the realm still signs with it, and `algorithm` with `certificate` reports how strong that signature is. A realm that signs with HS256 shares the signing secret with every client that validates it, so any one of them can forge a token for the rest.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"keys":{"name":"keys","type":"\u0019\u001bkeycloak.realm.key","title":"Signing keys the realm holds","desc":"An active key is one the realm signs tokens with. Its algorithm and size decide how hard a token is to forge.","provider":"go.mondoo.com/mql/providers/keycloak"},"loginWithEmailAllowed":{"name":"loginWithEmailAllowed","type":"\u0004","is_mandatory":true,"title":"Whether an email address is accepted in place of a user name at login","provider":"go.mondoo.com/mql/providers/keycloak"},"maxDeltaTimeSeconds":{"name":"maxDeltaTimeSeconds","type":"\u0005","is_mandatory":true,"title":"Seconds after which the failure count resets","provider":"go.mondoo.com/mql/providers/keycloak"},"maxFailureWaitSeconds":{"name":"maxFailureWaitSeconds","type":"\u0005","is_mandatory":true,"title":"Maximum seconds a temporary lockout can reach","provider":"go.mondoo.com/mql/providers/keycloak"},"maxTemporaryLockouts":{"name":"maxTemporaryLockouts","type":"\u0005","is_mandatory":true,"title":"Number of temporary lockouts before a permanent one, when permanent lockout is off","provider":"go.mondoo.com/mql/providers/keycloak"},"minimumQuickLoginWaitSeconds":{"name":"minimumQuickLoginWaitSeconds","type":"\u0005","is_mandatory":true,"title":"Minimum seconds a quick login is delayed","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Realm name as it appears in the issuer URL","provider":"go.mondoo.com/mql/providers/keycloak"},"offlineSessionIdleTimeout":{"name":"offlineSessionIdleTimeout","type":"\u0005","is_mandatory":true,"title":"Seconds an idle offline session survives","provider":"go.mondoo.com/mql/providers/keycloak"},"offlineSessionMaxLifespan":{"name":"offlineSessionMaxLifespan","type":"\u0005","is_mandatory":true,"title":"Seconds an offline session survives regardless of activity","provider":"go.mondoo.com/mql/providers/keycloak"},"offlineSessionMaxLifespanEnabled":{"name":"offlineSessionMaxLifespanEnabled","type":"\u0004","is_mandatory":true,"title":"Whether offline sessions have a maximum lifespan at all","provider":"go.mondoo.com/mql/providers/keycloak"},"otpPolicyAlgorithm":{"name":"otpPolicyAlgorithm","type":"\u0007","is_mandatory":true,"title":"Hash algorithm of the one-time password, such as HmacSHA1 or HmacSHA256","provider":"go.mondoo.com/mql/providers/keycloak"},"otpPolicyDigits":{"name":"otpPolicyDigits","type":"\u0005","is_mandatory":true,"title":"Number of digits in a one-time password","provider":"go.mondoo.com/mql/providers/keycloak"},"otpPolicyPeriod":{"name":"otpPolicyPeriod","type":"\u0005","is_mandatory":true,"title":"Seconds a time-based one-time password stays valid","provider":"go.mondoo.com/mql/providers/keycloak"},"otpPolicyType":{"name":"otpPolicyType","type":"\u0007","is_mandatory":true,"title":"One-time password algorithm family, either totp or hotp","provider":"go.mondoo.com/mql/providers/keycloak"},"passwordPolicy":{"name":"passwordPolicy","type":"\u0007","is_mandatory":true,"title":"Password policy in the raw form Keycloak stores it","desc":"A policy string such as `length(12) and digits(1) and notUsername(undefined)`. An empty value means the realm imposes no password rules at all. The parsed form is in passwordPolicyRules.","provider":"go.mondoo.com/mql/providers/keycloak"},"passwordPolicyRules":{"name":"passwordPolicyRules","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Password policy parsed into its named rules","desc":"Keyed by rule name, such as length, digits, upperCase, specialChars, notUsername, passwordHistory or forceExpiredPasswordChange, with the rule's argument as the value. A rule that takes no argument holds an empty value. Use it to assert on one rule without parsing the policy string, for example `passwordPolicyRules[\"length\"]`.","provider":"go.mondoo.com/mql/providers/keycloak"},"permanentLockout":{"name":"permanentLockout","type":"\u0004","is_mandatory":true,"title":"Whether a locked account stays locked until an administrator releases it","provider":"go.mondoo.com/mql/providers/keycloak"},"quickLoginCheckMilliSeconds":{"name":"quickLoginCheckMilliSeconds","type":"\u0005","is_mandatory":true,"title":"Milliseconds within which repeated logins count as one quick login","provider":"go.mondoo.com/mql/providers/keycloak"},"refreshTokenMaxReuse":{"name":"refreshTokenMaxReuse","type":"\u0005","is_mandatory":true,"title":"Number of times a refresh token may be reused when revocation is on","provider":"go.mondoo.com/mql/providers/keycloak"},"registrationAllowed":{"name":"registrationAllowed","type":"\u0004","is_mandatory":true,"title":"Whether users may register themselves","desc":"Self-registration lets anyone who reaches the login page create an account in the realm, which matters most where realm roles or groups are granted by default.","provider":"go.mondoo.com/mql/providers/keycloak"},"registrationEmailAsUsername":{"name":"registrationEmailAsUsername","type":"\u0004","is_mandatory":true,"title":"Whether a registering user supplies an email address as the user name","provider":"go.mondoo.com/mql/providers/keycloak"},"registrationFlow":{"name":"registrationFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used for self-registration","provider":"go.mondoo.com/mql/providers/keycloak"},"registrationFlowRef":{"name":"registrationFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to self-registration","provider":"go.mondoo.com/mql/providers/keycloak"},"rememberMe":{"name":"rememberMe","type":"\u0004","is_mandatory":true,"title":"Whether the login page offers to keep the session beyond the browser","desc":"A remembered session uses the ssoSessionIdleTimeoutRememberMe and ssoSessionMaxLifespanRememberMe windows instead of the ordinary ones, so it commonly outlives them by days.","provider":"go.mondoo.com/mql/providers/keycloak"},"requiredAction":{"name":"requiredAction","type":"\u001bkeycloak.realm.requiredAction","title":"Keycloak Required Action","desc":"An action the realm can ask a user to complete after authenticating, such as configuring a one-time password or updating a password. The `enabled` field reports whether the action is available at all, and `defaultAction` reports whether every new user is asked for it. A realm where CONFIGURE_TOTP is enabled but not a default action offers a second factor without requiring one.","is_private":true,"provider":"go.mondoo.com/mql/providers/keycloak","is_implicit_resource":true},"requiredActions":{"name":"requiredActions","type":"\u0019\u001bkeycloak.realm.requiredAction","title":"Actions a user can be asked to complete after login","provider":"go.mondoo.com/mql/providers/keycloak"},"resetCredentialsFlow":{"name":"resetCredentialsFlow","type":"\u0007","is_mandatory":true,"title":"Alias of the flow used to reset credentials","provider":"go.mondoo.com/mql/providers/keycloak"},"resetCredentialsFlowRef":{"name":"resetCredentialsFlowRef","type":"\u001bkeycloak.authenticationFlow","title":"Flow bound to credential reset","provider":"go.mondoo.com/mql/providers/keycloak"},"resetPasswordAllowed":{"name":"resetPasswordAllowed","type":"\u0004","is_mandatory":true,"title":"Whether users may reset their own password from the login page","provider":"go.mondoo.com/mql/providers/keycloak"},"revokeRefreshToken":{"name":"revokeRefreshToken","type":"\u0004","is_mandatory":true,"title":"Whether a refresh token is invalidated once it is used","provider":"go.mondoo.com/mql/providers/keycloak"},"roles":{"name":"roles","type":"\u0019\u001bkeycloak.role","title":"Realm roles defined in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"sslRequired":{"name":"sslRequired","type":"\u0007","is_mandatory":true,"title":"Where TLS is required","desc":"One of all, external or none. The value external exempts requests from private networks, and none accepts plaintext from anywhere, which exposes every credential and token the realm issues.","provider":"go.mondoo.com/mql/providers/keycloak"},"ssoSessionIdleTimeout":{"name":"ssoSessionIdleTimeout","type":"\u0005","is_mandatory":true,"title":"Seconds an idle single sign-on session survives","provider":"go.mondoo.com/mql/providers/keycloak"},"ssoSessionIdleTimeoutRememberMe":{"name":"ssoSessionIdleTimeoutRememberMe","type":"\u0005","is_mandatory":true,"title":"Seconds an idle remembered session survives","provider":"go.mondoo.com/mql/providers/keycloak"},"ssoSessionMaxLifespan":{"name":"ssoSessionMaxLifespan","type":"\u0005","is_mandatory":true,"title":"Seconds a single sign-on session survives regardless of activity","desc":"A revoked user keeps a working session until this window closes, so a long lifespan widens the gap between disabling an account and losing access.","provider":"go.mondoo.com/mql/providers/keycloak"},"ssoSessionMaxLifespanRememberMe":{"name":"ssoSessionMaxLifespanRememberMe","type":"\u0005","is_mandatory":true,"title":"Seconds a remembered session survives regardless of activity","provider":"go.mondoo.com/mql/providers/keycloak"},"users":{"name":"users","type":"\u0019\u001bkeycloak.user","title":"Users in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"verifyEmail":{"name":"verifyEmail","type":"\u0004","is_mandatory":true,"title":"Whether a new user must confirm the email address","provider":"go.mondoo.com/mql/providers/keycloak"},"waitIncrementSeconds":{"name":"waitIncrementSeconds","type":"\u0005","is_mandatory":true,"title":"Seconds a lockout lasts before the wait doubles","provider":"go.mondoo.com/mql/providers/keycloak"}},"init":{"args":[{"name":"name","type":"\u0007"}]},"title":"Keycloak Realm","desc":"A Keycloak realm and the authentication posture that applies to every client and user under it. Query `passwordPolicy` and `passwordPolicyRules` for the credential rules, `bruteForceProtected` with `failureFactor` and `permanentLockout` for lockout, `sslRequired` for transport enforcement, `registrationAllowed` and `rememberMe` for self-service exposure, and the `accessTokenLifespan` and `ssoSession*` fields for how long a session outlives a revocation. The `browserFlow` and `directGrantFlow` bindings name the authentication flows in force, which is what makes a missing multi-factor step detectable. Select a realm with `keycloak.realms.where(name == \"production\")`.","min_provider_version":"13.0.0","defaults":"name enabled sslRequired","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.realm.eventsConfig":{"id":"keycloak.realm.eventsConfig","name":"keycloak.realm.eventsConfig","fields":{"adminEventsDetailsEnabled":{"name":"adminEventsDetailsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether administrative events record the full request body","provider":"go.mondoo.com/mql/providers/keycloak"},"adminEventsEnabled":{"name":"adminEventsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether administrative changes are recorded","provider":"go.mondoo.com/mql/providers/keycloak"},"enabledEventTypes":{"name":"enabledEventTypes","type":"\u0019\u0007","is_mandatory":true,"title":"Event types the realm records","desc":"A realm that records LOGIN but not LOGIN_ERROR keeps no trace of a password guessing run.","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsEnabled":{"name":"eventsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether login events are recorded","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsExpiration":{"name":"eventsExpiration","type":"\u0005","is_mandatory":true,"title":"Seconds a login event is kept, or 0 when events never expire","provider":"go.mondoo.com/mql/providers/keycloak"},"eventsListeners":{"name":"eventsListeners","type":"\u0019\u0007","is_mandatory":true,"title":"Sinks the events are sent to","desc":"Contains jboss-logging on a stock install, which writes to the server log and nowhere else.","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the configuration belongs to","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Realm Event Configuration","desc":"What the realm records and where it sends it. The `eventsEnabled` and `adminEventsEnabled` fields report whether recording is on at all, and `enabledEventTypes` reports which login events are kept, since a realm can record logins while dropping the failure events an audit needs. The `eventsListeners` field names the sinks, and a realm with only the built-in logging listener keeps nothing outside the server.","private":true,"min_provider_version":"13.0.0","defaults":"eventsEnabled adminEventsEnabled","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.realm.key":{"id":"keycloak.realm.key","name":"keycloak.realm.key","fields":{"algorithm":{"name":"algorithm","type":"\u0007","is_mandatory":true,"title":"Signature or encryption algorithm, for example RS256, ES256 or HS256","provider":"go.mondoo.com/mql/providers/keycloak"},"certificate":{"name":"certificate","type":"\u0007","is_mandatory":true,"title":"Public certificate of the key, when it has one","provider":"go.mondoo.com/mql/providers/keycloak"},"isActive":{"name":"isActive","type":"\u0004","is_mandatory":true,"title":"Whether the realm signs new tokens with this key","provider":"go.mondoo.com/mql/providers/keycloak"},"kid":{"name":"kid","type":"\u0007","is_mandatory":true,"title":"Key identifier, which appears in a token header as kid","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Component that provides the key, for example rsa-generated or hmac-generated","provider":"go.mondoo.com/mql/providers/keycloak"},"providerPriority":{"name":"providerPriority","type":"\u0005","is_mandatory":true,"title":"Identifier of the providing component","provider":"go.mondoo.com/mql/providers/keycloak"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"Public modulus of an RSA key","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the key belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the key","desc":"One of ACTIVE, PASSIVE or DISABLED. An ACTIVE key signs new tokens, a PASSIVE key only validates tokens already issued, and a DISABLED key does neither.","provider":"go.mondoo.com/mql/providers/keycloak"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Key type, for example RSA, EC or OCT","provider":"go.mondoo.com/mql/providers/keycloak"},"use":{"name":"use","type":"\u0007","is_mandatory":true,"title":"What the key is used for, either SIG for signing or ENC for encryption","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Realm Signing Key","desc":"A cryptographic key the realm holds for signing or encrypting tokens. The `status` field reports whether the realm still signs with it, and `algorithm` with `certificate` reports how strong that signature is. A realm that signs with HS256 shares the signing secret with every client that validates it, so any one of them can forge a token for the rest.","private":true,"min_provider_version":"13.0.0","defaults":"algorithm status use","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.realm.requiredAction":{"id":"keycloak.realm.requiredAction","name":"keycloak.realm.requiredAction","fields":{"alias":{"name":"alias","type":"\u0007","is_mandatory":true,"title":"Identifier of the action, such as CONFIGURE_TOTP, UPDATE_PASSWORD or VERIFY_EMAIL","provider":"go.mondoo.com/mql/providers/keycloak"},"config":{"name":"config","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Provider-specific settings of the action","provider":"go.mondoo.com/mql/providers/keycloak"},"defaultAction":{"name":"defaultAction","type":"\u0004","is_mandatory":true,"title":"Whether every new user is asked to complete the action","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the action is available in the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable name of the action","provider":"go.mondoo.com/mql/providers/keycloak"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Order the action runs in relative to the others","provider":"go.mondoo.com/mql/providers/keycloak"},"providerId":{"name":"providerId","type":"\u0007","is_mandatory":true,"title":"Provider that implements the action","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the action belongs to","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Required Action","desc":"An action the realm can ask a user to complete after authenticating, such as configuring a one-time password or updating a password. The `enabled` field reports whether the action is available at all, and `defaultAction` reports whether every new user is asked for it. A realm where CONFIGURE_TOTP is enabled but not a default action offers a second factor without requiring one.","private":true,"min_provider_version":"13.0.0","defaults":"alias enabled defaultAction","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.role":{"id":"keycloak.role","name":"keycloak.role","fields":{"attributes":{"name":"attributes","type":"\n","is_mandatory":true,"title":"Custom attributes attached to the role","desc":"Keyed by the attribute name, with a list of values, since Keycloak stores every role attribute as a list even when it holds one value.","provider":"go.mondoo.com/mql/providers/keycloak"},"client":{"name":"client","type":"\u001bkeycloak.client","title":"Client that defines the role, or null for a realm role","provider":"go.mondoo.com/mql/providers/keycloak"},"clientRole":{"name":"clientRole","type":"\u0004","is_mandatory":true,"title":"Whether the role is defined by a client rather than by the realm","provider":"go.mondoo.com/mql/providers/keycloak"},"composite":{"name":"composite","type":"\u0004","is_mandatory":true,"title":"Whether the role grants other roles","provider":"go.mondoo.com/mql/providers/keycloak"},"composites":{"name":"composites","type":"\u0019\u001bkeycloak.role","title":"Roles this role grants","desc":"Empty when the role is not composite. A composite role can nest further composites, so a grant here can reach roles that are several levels away.","provider":"go.mondoo.com/mql/providers/keycloak"},"containerId":{"name":"containerId","type":"\u0007","is_mandatory":true,"title":"Identifier of the realm or client the role belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal role identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the role belongs to","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak Role","desc":"A role in a realm or on a client, and the roles it carries with it. The `composite` field reports whether the role grants other roles, and `composites` resolves them, which is how a role that looks harmless turns out to carry realm-admin. The `clientRole` field distinguishes a role defined by a client from a realm role, and `client` names that client.","private":true,"min_provider_version":"13.0.0","defaults":"name clientRole composite","provider":"go.mondoo.com/mql/providers/keycloak"},"keycloak.user":{"id":"keycloak.user","name":"keycloak.user","fields":{"allRoles":{"name":"allRoles","type":"\u0019\u001bkeycloak.role","title":"Every role mapped to the account, realm and client alike","provider":"go.mondoo.com/mql/providers/keycloak"},"attributes":{"name":"attributes","type":"\n","is_mandatory":true,"title":"Custom attributes attached to the account","desc":"Keyed by the attribute name, with a list of values, since Keycloak stores every user attribute as a list even when it holds one value.","provider":"go.mondoo.com/mql/providers/keycloak"},"clientRoleMappings":{"name":"clientRoleMappings","type":"\u0019\u001bkeycloak.role","title":"Client roles mapped to the account","desc":"The realm-management roles administer the realm, so this is where a service account's administrative reach becomes visible.","provider":"go.mondoo.com/mql/providers/keycloak"},"createdTimestamp":{"name":"createdTimestamp","type":"\t","is_mandatory":true,"title":"Time the account was created","provider":"go.mondoo.com/mql/providers/keycloak"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address","provider":"go.mondoo.com/mql/providers/keycloak"},"emailVerified":{"name":"emailVerified","type":"\u0004","is_mandatory":true,"title":"Whether the email address has been confirmed","provider":"go.mondoo.com/mql/providers/keycloak"},"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the account may authenticate","provider":"go.mondoo.com/mql/providers/keycloak"},"federationLink":{"name":"federationLink","type":"\u0007","is_mandatory":true,"title":"Identifier of the user federation provider the account comes from","desc":"Empty for an account stored in Keycloak itself. A federated account's lifecycle is controlled by the directory it comes from.","provider":"go.mondoo.com/mql/providers/keycloak"},"firstName":{"name":"firstName","type":"\u0007","is_mandatory":true,"title":"Given name","provider":"go.mondoo.com/mql/providers/keycloak"},"groups":{"name":"groups","type":"\u0019\u001bkeycloak.group","title":"Groups the account belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"hasAdminRole":{"name":"hasAdminRole","type":"\u0004","title":"Whether the account holds a realm administration role","desc":"True when a realm role or a realm-management client role the account holds grants administration of the realm, directly or through a composite. A service account holding one gives every holder of the client's secret full control of the realm.","provider":"go.mondoo.com/mql/providers/keycloak"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Internal user identifier","provider":"go.mondoo.com/mql/providers/keycloak"},"isServiceAccount":{"name":"isServiceAccount","type":"\u0004","is_mandatory":true,"title":"Whether the account is a client's service account","provider":"go.mondoo.com/mql/providers/keycloak"},"lastName":{"name":"lastName","type":"\u0007","is_mandatory":true,"title":"Family name","provider":"go.mondoo.com/mql/providers/keycloak"},"realm":{"name":"realm","type":"\u001bkeycloak.realm","title":"Realm the account belongs to","provider":"go.mondoo.com/mql/providers/keycloak"},"requiredActions":{"name":"requiredActions","type":"\u0019\u0007","is_mandatory":true,"title":"Actions the user must complete at the next login","desc":"Contains entries such as UPDATE_PASSWORD, CONFIGURE_TOTP or VERIFY_EMAIL. An account carrying UPDATE_PASSWORD has a credential that an administrator set rather than the user.","provider":"go.mondoo.com/mql/providers/keycloak"},"roles":{"name":"roles","type":"\u0019\u001bkeycloak.role","title":"Realm roles mapped to the account","provider":"go.mondoo.com/mql/providers/keycloak"},"serviceAccountClient":{"name":"serviceAccountClient","type":"\u001bkeycloak.client","title":"Client this account is the service account of, or null for an ordinary user","provider":"go.mondoo.com/mql/providers/keycloak"},"serviceAccountClientId":{"name":"serviceAccountClientId","type":"\u0007","is_mandatory":true,"title":"Identifier of the client this account is the service account of","desc":"Empty for an ordinary user. A service account authenticates with the client's secret rather than with a password, and no second factor applies to it.","provider":"go.mondoo.com/mql/providers/keycloak"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"User name","provider":"go.mondoo.com/mql/providers/keycloak"}},"title":"Keycloak User","desc":"A user of a realm, including the service account users that clients authenticate as. Query `enabled` and `emailVerified` for the account state, `requiredActions` for what the user is still asked to complete, `federationLink` for whether the account comes from an external directory, and `serviceAccountClientId` for whether it belongs to a client rather than a person. The `hasAdminRole` field reports whether the account holds a realm administration role, directly or through a composite, which is what turns a leaked client secret into full control of the realm.","private":true,"min_provider_version":"13.0.0","defaults":"username enabled emailVerified","provider":"go.mondoo.com/mql/providers/keycloak"}}}