OpenID Client Scopes

Use these resources when you want to group protocol mappers and role scope mappings so they can be reused across multiple clients. Default scopes are always included in tokens, while optional scopes are only added when explicitly requested.

API Reference

Kind	API Group	Terraform Resource	CRD Explorer
ClientScope	`openidclient.keycloak.crossplane.io/v1alpha1`	`keycloak_openid_client_scope`	View CRD Schema
ClientDefaultScopes	`openidclient.keycloak.crossplane.io/v1alpha1`	`keycloak_openid_client_default_scopes`	View CRD Schema
ClientOptionalScopes	`openidclient.keycloak.crossplane.io/v1alpha1`	`keycloak_openid_client_optional_scopes`	View CRD Schema

Working YAML Examples

`ClientScope`

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientScope
metadata:
  name: openid-client-scope
spec:
  deletionPolicy: Delete
  providerConfigRef:
    name: "keycloak-provider-config"
  forProvider:
    description: When requested, this scope will map a user's group memberships to a claim
    guiOrder: 1
    includeInTokenScope: true
    name: my-groups
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always

`ClientDefaultScopes`

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientDefaultScopes
metadata:
  name: client-default-scopes
spec:
  deletionPolicy: Delete
  forProvider:
    clientIdRef:
      name: "test"
      policy:
        resolve: Always
    defaultScopes:
      - profile
      - email
      - roles
      - web-origins
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
  providerConfigRef:
    name: "keycloak-provider-config"

`ClientOptionalScopes`

apiVersion: openidclient.keycloak.crossplane.io/v1alpha1
kind: ClientOptionalScopes
metadata:
  name: client-optional-scopes
spec:
  deletionPolicy: Delete
  forProvider:
    clientIdRef:
      name: "test"
      policy:
        resolve: Always
    optionalScopes:
      - address
      - phone
      - offline_access
      - microprofile-jwt
      - my-groups
    realmIdRef:
      name: "dev"
      policy:
        resolve: Always
  providerConfigRef:
    name: "keycloak-provider-config"

Related Resources

Identity Providers Organizations