Chapter 23. KafkaAuthorizationKeycloak schema reference
Chapter 23. KafkaAuthorizationKeycloak schema reference Used in: KafkaClusterSpec The type property is a discriminator that distinguishes use of the KafkaAuthorizationKeycloak type from KafkaAuthorizationSimple , KafkaAuthorizationOpa , KafkaAuthorizationCustom . It must have the value keycloak for the type KafkaAuthorizationKeycloak . Property Property type Description type string Must be keycloak . clientId string OAuth Client ID which the Kafka client can use to authenticate against the OAuth server and use the token endpoint URI. tokenEndpointUri string Authorization server token endpoint URI. tlsTrustedCertificates CertSecretSource array Trusted certificates for TLS connection to the OAuth server. disableTlsHostnameVerification boolean Enable or disable TLS hostname verification. Default value is false . delegateToKafkaAcls boolean Whether authorization decision should be delegated to the 'Simple' authorizer if DENIED by Red Hat build of Keycloak Authorization Services policies. Default value is false . grantsRefreshPeriodSeconds integer The time between two consecutive grants refresh runs in seconds. The default value is 60. grantsRefreshPoolSize integer The number of threads to use to refresh grants for active sessions. The more threads, the more parallelism, so the sooner the job completes. However, using more threads places a heavier load on the authorization server. The default value is 5. grantsMaxIdleTimeSeconds integer The time, in seconds, after which an idle grant can be evicted from the cache. The default value is 300. grantsGcPeriodSeconds integer The time, in seconds, between consecutive runs of a job that cleans stale grants from the cache. The default value is 300. grantsAlwaysLatest boolean Controls whether the latest grants are fetched for a new session. When enabled, grants are retrieved from Red Hat build of Keycloak and cached for the user. The default value is false . superUsers string array List of super users. Should contain list of user principals which should get unlimited access rights. connectTimeoutSeconds integer The connect timeout in seconds when connecting to authorization server. If not set, the effective connect timeout is 60 seconds. readTimeoutSeconds integer The read timeout in seconds when connecting to authorization server. If not set, the effective read timeout is 60 seconds. httpRetries integer The maximum number of retries to attempt if an initial HTTP request fails. If not set, the default is to not attempt any retries. enableMetrics boolean Enable or disable OAuth metrics. The default value is false . includeAcceptHeader boolean Whether the Accept header should be set in requests to the authorization servers. The default value is true .