Clients

Use a Client when an application or service needs Keycloak to authenticate users with OpenID Connect. This is the resource for web apps, SPAs, backend services, service accounts, and federated workloads.

API Reference

Kind	API Group	Terraform Resource	CRD Explorer
Client	`openidclient.keycloak.crossplane.io/v1alpha1`	`keycloak_openid_client`	View CRD Schema
ClientAdminPermissions	`openidclient.keycloak.crossplane.io/v1alpha1`	`keycloak_openid_client_admin_permissions`	View CRD Schema

Examples

Confidential client with authorization

apiVersion: openidclient.keycloak.crossplane.io/v1alpha2
kind: Client
metadata:
  name: test
spec:
  deletionPolicy: Delete
  forProvider:
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    accessType: "CONFIDENTIAL"
    clientId: "test"
    fullScopeAllowed: false
    serviceAccountsEnabled: true
    authorization:
      - policyEnforcementMode: "PERMISSIVE"
  providerConfigRef:
    name: "keycloak-provider-config"

Managing a built-in client without deleting it

apiVersion: openidclient.keycloak.crossplane.io/v1alpha2
kind: Client
metadata:
  name: account
spec:
  managementPolicies: ["Create", "Update", "Observe"]
  forProvider:
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    accessType: "CONFIDENTIAL"
    clientId: "account"
  providerConfigRef:
    name: "keycloak-provider-config"

Managing another built-in client (account-console)

apiVersion: openidclient.keycloak.crossplane.io/v1alpha2
kind: Client
metadata:
  name: account-console
spec:
  managementPolicies: [Observe, Update]
  deletionPolicy: Orphan
  forProvider:
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    accessType: "PUBLIC"
    clientId: "account-console"
  providerConfigRef:
    name: "keycloak-provider-config"

Service account client

apiVersion: openidclient.keycloak.crossplane.io/v1alpha2
kind: Client
metadata:
  name: service-acc-1
spec:
  deletionPolicy: Delete
  forProvider:
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    accessType: "CONFIDENTIAL"
    clientId: "service-acc-1"
    serviceAccountsEnabled: true
  providerConfigRef:
    name: "keycloak-provider-config"

Kubernetes federated JWT client

apiVersion: openidclient.keycloak.crossplane.io/v1alpha2
kind: Client
metadata:
  name: k8s-federated-client
spec:
  deletionPolicy: Delete
  forProvider:
    accessType: CONFIDENTIAL
    clientAuthenticatorType: federated-jwt
    clientId: k8s-federated-client
    enabled: true
    name: k8s-federated-client
    realmIdRef:
      name: "orgs"
      policy:
        resolve: Always
    serviceAccountsEnabled: true
    standardFlowEnabled: false
    extraConfig:
      federated.idp: k8s-federated
      federated.sub: system:serviceaccount:default:k8s-federated-test-sa
  providerConfigRef:
    name: "keycloak-provider-config"

Fine-grained admin permissions (v2)

ClientAdminPermissions manages a single fine-grained admin permission for the clients of a realm. It requires Keycloak 26.2 or newer started with the admin-fine-grained-authz:v2 feature and a realm with adminPermissionsEnabled: true. Keycloak then creates an admin-permissions client for the realm that acts as the resource server for all of its admin permissions.

admin-fine-grained-authz:v2 replaces admin-fine-grained-authz:v1, so ClientAdminPermissions and the v1 permission resources cannot be used against the same Keycloak instance.

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientAdminPermissions
metadata:
  name: admins-manage-clients
spec:
  deletionPolicy: Delete
  forProvider:
    name: admins-can-manage-clients
    description: Admins can view and manage the referenced client
    decisionStrategy: UNANIMOUS
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
    clientIdsRefs:
      - name: "test"
    scopes:
      - view
      - manage
  providerConfigRef:
    name: "keycloak-provider-config"

Without clientIds the permission applies to every client of the realm, otherwise only to the referenced clients. Both OpenID clients (clientIdsRefs) and SAML clients (samlClientIdsRefs) can be referenced. A permission without policies is evaluated as “deny”, so attach policies once they exist on the realm’s admin-permissions client, either by ID via policies or through the typed reference fields (groupPolicies, rolePolicies, userPolicies, …).

Key Fields

Field	Description
`accessType`	Client type. Use `CONFIDENTIAL` for server-side apps, `PUBLIC` for browser or native apps, and `BEARER-ONLY` for APIs that only validate tokens.
`clientId`	Unique client identifier in the realm.
`serviceAccountsEnabled`	Enables a service account so the client can use client credentials flows.
`fullScopeAllowed`	Controls whether the client automatically receives all realm and client scopes.
`authorization`	Enables and configures Keycloak Authorization Services for the client.
`standardFlowEnabled`	Enables the authorization code flow.
`implicitFlowEnabled`	Enables the implicit flow for legacy browser-based integrations.
`directAccessGrantsEnabled`	Enables direct username/password token grants.
`clientAuthenticatorType`	Selects how the client authenticates, such as standard secret-based auth or `federated-jwt`.

Related Resources

Client Authorization Default Configuration