
:guide-id: all-provider-config
:guide-title: All provider configuration
:guide-summary: Complete list of all the available provider configuration options
:guide-priority: 999
:guide-tile-visible: true
:version: 26.2.2

include::../attributes.adoc[]

[[all-provider-config]]
= All provider configuration

ifeval::["" == "true"]
WARNING: This {section} is describing a feature which is currently in preview.
ifeval::["" == ""]
Please provide your feedback while we’re continuing to work on this.
endif::[]
ifeval::["" != ""]
Please provide your feedback by link:[joining this discussion] while we’re continuing to work on this.
endif::[]
endif::[]


== authentication-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-authentication-sessions-infinispan-auth-sessions-limit``# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended-spi-authentication-sessions-infinispan-auth-sessions-limit,role="options-extended"]
--


*CLI:* `--spi-authentication-sessions-infinispan-auth-sessions-limit` +
*Env:* `KC_SPI_AUTHENTICATION_SESSIONS_INFINISPAN_AUTH_SESSIONS_LIMIT`
--



|[.options-default]#`+300+`# (default) or any `+int+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-authentication-sessions-remote-auth-sessions-limit``# 

[.options-description]#The maximum number of concurrent authentication sessions per RootAuthenticationSession.#

[#option-extended-spi-authentication-sessions-remote-auth-sessions-limit,role="options-extended"]
--


*CLI:* `--spi-authentication-sessions-remote-auth-sessions-limit` +
*Env:* `KC_SPI_AUTHENTICATION_SESSIONS_REMOTE_AUTH_SESSIONS_LIMIT`
--



|[.options-default]#`+300+`# (default) or any `+int+`

|
[.options-key]#``spi-authentication-sessions-remote-max-retries``# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended-spi-authentication-sessions-remote-max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `--spi-authentication-sessions-remote-max-retries` +
*Env:* `KC_SPI_AUTHENTICATION_SESSIONS_REMOTE_MAX_RETRIES`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#``spi-authentication-sessions-remote-retry-base-time``# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended-spi-authentication-sessions-remote-retry-base-time,role="options-extended"]
--


*CLI:* `--spi-authentication-sessions-remote-retry-base-time` +
*Env:* `KC_SPI_AUTHENTICATION_SESSIONS_REMOTE_RETRY_BASE_TIME`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== brute-force-protector
=== default-brute-force-detector
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests``# 

[.options-description]#If concurrent logins are allowed by the brute force protection.#

[#option-extended-spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests,role="options-extended"]
--


*CLI:* `--spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests` +
*Env:* `KC_SPI_BRUTE_FORCE_PROTECTOR_DEFAULT_BRUTE_FORCE_DETECTOR_ALLOW_CONCURRENT_REQUESTS`
--



|
`+true+`, `+false+` (default)


|===
== ciba-auth-channel
=== ciba-http-auth-channel
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri``# 

[.options-description]#The HTTP(S) URI of the authentication channel.#

[#option-extended-spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri,role="options-extended"]
--


*CLI:* `--spi-ciba-auth-channel-ciba-http-auth-channel-http-authentication-channel-uri` +
*Env:* `KC_SPI_CIBA_AUTH_CHANNEL_CIBA_HTTP_AUTH_CHANNEL_HTTP_AUTHENTICATION_CHANNEL_URI`
--



|any `+string+`


|===
== connections-http-client
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-connections-http-client-default-client-key-password``# 

[.options-description]#The key password.#

[#option-extended-spi-connections-http-client-default-client-key-password,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-client-key-password` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_CLIENT_KEY_PASSWORD`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#``spi-connections-http-client-default-client-keystore``# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended-spi-connections-http-client-default-client-keystore,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-client-keystore` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_CLIENT_KEYSTORE`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-default-client-keystore-password``# 

[.options-description]#The key store password.#

[#option-extended-spi-connections-http-client-default-client-keystore-password,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-client-keystore-password` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_CLIENT_KEYSTORE_PASSWORD`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-default-connection-pool-size``# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended-spi-connections-http-client-default-connection-pool-size,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-connection-pool-size` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_CONNECTION_POOL_SIZE`
--



|any `+int+`

|
[.options-key]#``spi-connections-http-client-default-connection-ttl-millis``# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended-spi-connections-http-client-default-connection-ttl-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-connection-ttl-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_CONNECTION_TTL_MILLIS`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-default-disable-cookies``# 

[.options-description]#Disables state (cookie) management.#

[#option-extended-spi-connections-http-client-default-disable-cookies,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-disable-cookies` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_DISABLE_COOKIES`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-connections-http-client-default-disable-trust-manager``# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended-spi-connections-http-client-default-disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#

*CLI:* `--spi-connections-http-client-default-disable-trust-manager` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_DISABLE_TRUST_MANAGER`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#``spi-connections-http-client-default-establish-connection-timeout-millis``# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended-spi-connections-http-client-default-establish-connection-timeout-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-establish-connection-timeout-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_ESTABLISH_CONNECTION_TIMEOUT_MILLIS`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-default-max-connection-idle-time-millis``# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended-spi-connections-http-client-default-max-connection-idle-time-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-max-connection-idle-time-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_MAX_CONNECTION_IDLE_TIME_MILLIS`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-default-max-consumed-response-size``# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended-spi-connections-http-client-default-max-consumed-response-size,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-max-consumed-response-size` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_MAX_CONSUMED_RESPONSE_SIZE`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-default-max-pooled-per-route``# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended-spi-connections-http-client-default-max-pooled-per-route,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-max-pooled-per-route` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_MAX_POOLED_PER_ROUTE`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#``spi-connections-http-client-default-proxy-mappings``# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended-spi-connections-http-client-default-proxy-mappings,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-proxy-mappings` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_PROXY_MAPPINGS`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-default-reuse-connections``# 

[.options-description]#If connections should be reused.#

[#option-extended-spi-connections-http-client-default-reuse-connections,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-reuse-connections` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_REUSE_CONNECTIONS`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-connections-http-client-default-socket-timeout-millis``# 

[.options-description]#Socket inactivity timeout.#

[#option-extended-spi-connections-http-client-default-socket-timeout-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-default-socket-timeout-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_DEFAULT_SOCKET_TIMEOUT_MILLIS`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
=== opentelemetry
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-connections-http-client-opentelemetry-client-key-password``# 

[.options-description]#The key password.#

[#option-extended-spi-connections-http-client-opentelemetry-client-key-password,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-client-key-password` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_CLIENT_KEY_PASSWORD`
--



|[.options-default]#`+-1+`# (default) or any `+string+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-client-keystore``# 

[.options-description]#The file path of the key store from where the key material is going to be read from to set-up TLS connections.#

[#option-extended-spi-connections-http-client-opentelemetry-client-keystore,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-client-keystore` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_CLIENT_KEYSTORE`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-client-keystore-password``# 

[.options-description]#The key store password.#

[#option-extended-spi-connections-http-client-opentelemetry-client-keystore-password,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-client-keystore-password` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_CLIENT_KEYSTORE_PASSWORD`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-connection-pool-size``# 

[.options-description]#Assigns maximum total connection value.#

[#option-extended-spi-connections-http-client-opentelemetry-connection-pool-size,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-connection-pool-size` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_CONNECTION_POOL_SIZE`
--



|any `+int+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-connection-ttl-millis``# 

[.options-description]#Sets maximum time, in milliseconds, to live for persistent connections.#

[#option-extended-spi-connections-http-client-opentelemetry-connection-ttl-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-connection-ttl-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_CONNECTION_TTL_MILLIS`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-disable-cookies``# 

[.options-description]#Disables state (cookie) management.#

[#option-extended-spi-connections-http-client-opentelemetry-disable-cookies,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-disable-cookies` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_DISABLE_COOKIES`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-disable-trust-manager``# 

[.options-description]#Disable trust management and hostname verification.#

[#option-extended-spi-connections-http-client-opentelemetry-disable-trust-manager,role="options-extended"]
--
[.options-description-extended]#NOTE this is a security hole, so only set this option if you cannot or do not want to verify the identity of the host you are communicating with.#

*CLI:* `--spi-connections-http-client-opentelemetry-disable-trust-manager` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_DISABLE_TRUST_MANAGER`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#``spi-connections-http-client-opentelemetry-establish-connection-timeout-millis``# 

[.options-description]#When trying to make an initial socket connection, what is the timeout?#

[#option-extended-spi-connections-http-client-opentelemetry-establish-connection-timeout-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-establish-connection-timeout-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_ESTABLISH_CONNECTION_TIMEOUT_MILLIS`
--



|[.options-default]#`+-1+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-max-connection-idle-time-millis``# 

[.options-description]#Sets the time, in milliseconds, for evicting idle connections from the pool.#

[#option-extended-spi-connections-http-client-opentelemetry-max-connection-idle-time-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-max-connection-idle-time-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_MAX_CONNECTION_IDLE_TIME_MILLIS`
--



|[.options-default]#`+900000+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-max-consumed-response-size``# 

[.options-description]#Maximum size of a response consumed by the client (to prevent denial of service)#

[#option-extended-spi-connections-http-client-opentelemetry-max-consumed-response-size,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-max-consumed-response-size` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_MAX_CONSUMED_RESPONSE_SIZE`
--



|[.options-default]#`+10000000+`# (default) or any `+long+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-max-pooled-per-route``# 

[.options-description]#Assigns maximum connection per route value.#

[#option-extended-spi-connections-http-client-opentelemetry-max-pooled-per-route,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-max-pooled-per-route` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_MAX_POOLED_PER_ROUTE`
--



|[.options-default]#`+64+`# (default) or any `+int+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-proxy-mappings``# 

[.options-description]#Denotes the combination of a regex based hostname pattern and a proxy-uri in the form of hostnamePattern;proxyUri.#

[#option-extended-spi-connections-http-client-opentelemetry-proxy-mappings,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-proxy-mappings` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_PROXY_MAPPINGS`
--



|any `+string+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-reuse-connections``# 

[.options-description]#If connections should be reused.#

[#option-extended-spi-connections-http-client-opentelemetry-reuse-connections,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-reuse-connections` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_REUSE_CONNECTIONS`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-connections-http-client-opentelemetry-socket-timeout-millis``# 

[.options-description]#Socket inactivity timeout.#

[#option-extended-spi-connections-http-client-opentelemetry-socket-timeout-millis,role="options-extended"]
--


*CLI:* `--spi-connections-http-client-opentelemetry-socket-timeout-millis` +
*Env:* `KC_SPI_CONNECTIONS_HTTP_CLIENT_OPENTELEMETRY_SOCKET_TIMEOUT_MILLIS`
--



|[.options-default]#`+5000+`# (default) or any `+long+`


|===
== connections-infinispan
=== quarkus
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-connections-infinispan-quarkus-site-name``# 

[.options-description]#Site name for multi-site deployments#

[#option-extended-spi-connections-infinispan-quarkus-site-name,role="options-extended"]
--


*CLI:* `--spi-connections-infinispan-quarkus-site-name` +
*Env:* `KC_SPI_CONNECTIONS_INFINISPAN_QUARKUS_SITE_NAME`
--



|any `+string+`


|===
== connections-jpa
=== quarkus
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-connections-jpa-quarkus-initialize-empty``# 

[.options-description]#Initialize database if empty.#

[#option-extended-spi-connections-jpa-quarkus-initialize-empty,role="options-extended"]
--
[.options-description-extended]#If set to false the database has to be manually initialized. If you want to manually initialize the database set migrationStrategy to manual which will create a file with SQL commands to initialize the database.#

*CLI:* `--spi-connections-jpa-quarkus-initialize-empty` +
*Env:* `KC_SPI_CONNECTIONS_JPA_QUARKUS_INITIALIZE_EMPTY`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-connections-jpa-quarkus-migration-export``# 

[.options-description]#Path for where to write manual database initialization/migration file.#

[#option-extended-spi-connections-jpa-quarkus-migration-export,role="options-extended"]
--


*CLI:* `--spi-connections-jpa-quarkus-migration-export` +
*Env:* `KC_SPI_CONNECTIONS_JPA_QUARKUS_MIGRATION_EXPORT`
--



|any `+string+`

|
[.options-key]#``spi-connections-jpa-quarkus-migration-strategy``# 

[.options-description]#Strategy to use to migrate database.#

[#option-extended-spi-connections-jpa-quarkus-migration-strategy,role="options-extended"]
--
[.options-description-extended]#Valid values are update, manual and validate. Update will automatically migrate the database schema. Manual will export the required changes to a file with SQL commands that you can manually execute on the database. Validate will simply check if the database is up-to-date.#

*CLI:* `--spi-connections-jpa-quarkus-migration-strategy` +
*Env:* `KC_SPI_CONNECTIONS_JPA_QUARKUS_MIGRATION_STRATEGY`
--



|
`+update+` (default), `+manual+`, `+validate+`


|===
== credential
=== keycloak-password
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-credential-keycloak-password-validations-counter-tags``# 

[.options-description]#Comma-separated list of tags to be used when publishing password validation counter metric.#

[#option-extended-spi-credential-keycloak-password-validations-counter-tags,role="options-extended"]
--


*CLI:* `--spi-credential-keycloak-password-validations-counter-tags` +
*Env:* `KC_SPI_CREDENTIAL_KEYCLOAK_PASSWORD_VALIDATIONS_COUNTER_TAGS`
--



|
`+realm+`, `+algorithm+`, `+hashing_strength+`, `+outcome+`


|===
== crl-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-crl-storage-infinispan-cache-time``# 

[.options-description]#Interval in seconds that the CRL is cached.#

[#option-extended-spi-crl-storage-infinispan-cache-time,role="options-extended"]
--
[.options-description-extended]#The next update time of the CRL is always a minimum if present.
Zero or a negative value means CRL is cached until the next update time specified in the CRL (or infinite if the
CRL does not contain the next update).#

*CLI:* `--spi-crl-storage-infinispan-cache-time` +
*Env:* `KC_SPI_CRL_STORAGE_INFINISPAN_CACHE_TIME`
--



|[.options-default]#`+-1+`# (default) or any `+int+`

|
[.options-key]#``spi-crl-storage-infinispan-min-time-between-requests``# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the CRL.#

[#option-extended-spi-crl-storage-infinispan-min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The CRL is not updated
from the URL again until this minimum time has passed since the previous refresh. In theory
this option is never used if the CRL is refreshed correctly in the next update time.
The interval should be a positive number. Default 10 seconds.#

*CLI:* `--spi-crl-storage-infinispan-min-time-between-requests` +
*Env:* `KC_SPI_CRL_STORAGE_INFINISPAN_MIN_TIME_BETWEEN_REQUESTS`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== datastore
=== legacy
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-datastore-legacy-allow-migrate-existing-database-to-snapshot``# 

[.options-description]#By default, it is not allowed to run the snapshot/development server against the database, which was previously migrated to some officially released server version.#

[#option-extended-spi-datastore-legacy-allow-migrate-existing-database-to-snapshot,role="options-extended"]
--
[.options-description-extended]#As an attempt of doing this indicates that you are trying to run development server against production database, which can result in a loss or corruption of data, and also does not allow upgrading. If it is really intended, you can use this option, which will allow to use nightly/development server against production database when explicitly switch to true. This option is recommended just in the development environments and should be never used in the production!#

*CLI:* `--spi-datastore-legacy-allow-migrate-existing-database-to-snapshot` +
*Env:* `KC_SPI_DATASTORE_LEGACY_ALLOW_MIGRATE_EXISTING_DATABASE_TO_SNAPSHOT`
--



|
`+true+`, `+false+` (default)


|===
== dblock
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-dblock-jpa-lock-wait-timeout``# 

[.options-description]#The maximum time to wait when waiting to release a database lock.#

[#option-extended-spi-dblock-jpa-lock-wait-timeout,role="options-extended"]
--


*CLI:* `--spi-dblock-jpa-lock-wait-timeout` +
*Env:* `KC_SPI_DBLOCK_JPA_LOCK_WAIT_TIMEOUT`
--



|any `+int+`


|===
== events-listener
=== email
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-events-listener-email-exclude-events``# 

[.options-description]#A comma-separated list of events that should not be sent via email to the user's account.#

[#option-extended-spi-events-listener-email-exclude-events,role="options-extended"]
--


*CLI:* `--spi-events-listener-email-exclude-events` +
*Env:* `KC_SPI_EVENTS_LISTENER_EMAIL_EXCLUDE_EVENTS`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`

|
[.options-key]#``spi-events-listener-email-include-events``# 

[.options-description]#A comma-separated list of events that should be sent via email to the user's account.#

[#option-extended-spi-events-listener-email-include-events,role="options-extended"]
--


*CLI:* `--spi-events-listener-email-include-events` +
*Env:* `KC_SPI_EVENTS_LISTENER_EMAIL_INCLUDE_EVENTS`
--



|
`+authreqid_to_token+`, `+authreqid_to_token_error+`, `+client_delete+`, `+client_delete_error+`, `+client_info+`, `+client_info_error+`, `+client_initiated_account_linking+`, `+client_initiated_account_linking_error+`, `+client_login+`, `+client_login_error+`, `+client_register+`, `+client_register_error+`, `+client_update+`, `+client_update_error+`, `+code_to_token+`, `+code_to_token_error+`, `+custom_required_action+`, `+custom_required_action_error+`, `+delete_account+`, `+delete_account_error+`, `+execute_action_token+`, `+execute_action_token_error+`, `+execute_actions+`, `+execute_actions_error+`, `+federated_identity_link+`, `+federated_identity_link_error+`, `+federated_identity_override_link+`, `+federated_identity_override_link_error+`, `+grant_consent+`, `+grant_consent_error+`, `+identity_provider_first_login+`, `+identity_provider_first_login_error+`, `+identity_provider_link_account+`, `+identity_provider_link_account_error+`, `+identity_provider_login+`, `+identity_provider_login_error+`, `+identity_provider_post_login+`, `+identity_provider_post_login_error+`, `+identity_provider_response+`, `+identity_provider_response_error+`, `+identity_provider_retrieve_token+`, `+identity_provider_retrieve_token_error+`, `+impersonate+`, `+impersonate_error+`, `+introspect_token+`, `+introspect_token_error+`, `+invalid_signature+`, `+invalid_signature_error+`, `+invite_org+`, `+invite_org_error+`, `+login+`, `+login_error+`, `+logout+`, `+logout_error+`, `+oauth2_device_auth+`, `+oauth2_device_auth_error+`, `+oauth2_device_code_to_token+`, `+oauth2_device_code_to_token_error+`, `+oauth2_device_verify_user_code+`, `+oauth2_device_verify_user_code_error+`, `+oauth2_extension_grant+`, `+oauth2_extension_grant_error+`, `+permission_token+`, `+permission_token_error+`, `+pushed_authorization_request+`, `+pushed_authorization_request_error+`, `+refresh_token+`, `+refresh_token_error+`, `+register+`, `+register_error+`, `+register_node+`, `+register_node_error+`, `+remove_credential+`, `+remove_credential_error+`, `+remove_federated_identity+`, `+remove_federated_identity_error+`, `+remove_totp+`, `+remove_totp_error+`, `+reset_password+`, `+reset_password_error+`, `+restart_authentication+`, `+restart_authentication_error+`, `+revoke_grant+`, `+revoke_grant_error+`, `+send_identity_provider_link+`, `+send_identity_provider_link_error+`, `+send_reset_password+`, `+send_reset_password_error+`, `+send_verify_email+`, `+send_verify_email_error+`, `+token_exchange+`, `+token_exchange_error+`, `+unregister_node+`, `+unregister_node_error+`, `+update_consent+`, `+update_consent_error+`, `+update_credential+`, `+update_credential_error+`, `+update_email+`, `+update_email_error+`, `+update_password+`, `+update_password_error+`, `+update_profile+`, `+update_profile_error+`, `+update_totp+`, `+update_totp_error+`, `+user_disabled_by_permanent_lockout+`, `+user_disabled_by_permanent_lockout_error+`, `+user_disabled_by_temporary_lockout+`, `+user_disabled_by_temporary_lockout_error+`, `+user_info_request+`, `+user_info_request_error+`, `+validate_access_token+`, `+validate_access_token_error+`, `+verify_email+`, `+verify_email_error+`, `+verify_profile+`, `+verify_profile_error+`


|===
=== jboss-logging
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-events-listener-jboss-logging-error-level``# 

[.options-description]#The log level for error messages.#

[#option-extended-spi-events-listener-jboss-logging-error-level,role="options-extended"]
--


*CLI:* `--spi-events-listener-jboss-logging-error-level` +
*Env:* `KC_SPI_EVENTS_LISTENER_JBOSS_LOGGING_ERROR_LEVEL`
--



|
`+debug+`, `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+` (default)

|
[.options-key]#``spi-events-listener-jboss-logging-quotes``# 

[.options-description]#The quotes to use for values, it should be one character like " or '.#

[#option-extended-spi-events-listener-jboss-logging-quotes,role="options-extended"]
--
[.options-description-extended]#Use "none" if quotes are not needed.#

*CLI:* `--spi-events-listener-jboss-logging-quotes` +
*Env:* `KC_SPI_EVENTS_LISTENER_JBOSS_LOGGING_QUOTES`
--



|[.options-default]#`+"+`# (default) or any `+string+`

|
[.options-key]#``spi-events-listener-jboss-logging-sanitize``# 

[.options-description]#If true the log messages are sanitized to avoid line breaks.#

[#option-extended-spi-events-listener-jboss-logging-sanitize,role="options-extended"]
--
[.options-description-extended]#If false messages are not sanitized.#

*CLI:* `--spi-events-listener-jboss-logging-sanitize` +
*Env:* `KC_SPI_EVENTS_LISTENER_JBOSS_LOGGING_SANITIZE`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-events-listener-jboss-logging-success-level``# 

[.options-description]#The log level for success messages.#

[#option-extended-spi-events-listener-jboss-logging-success-level,role="options-extended"]
--


*CLI:* `--spi-events-listener-jboss-logging-success-level` +
*Env:* `KC_SPI_EVENTS_LISTENER_JBOSS_LOGGING_SUCCESS_LEVEL`
--



|
`+debug+` (default), `+error+`, `+fatal+`, `+info+`, `+trace+`, `+warn+`


|===
== export
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-export-dir-dir``# 

[.options-description]#Directory to export to#

[#option-extended-spi-export-dir-dir,role="options-extended"]
--


*CLI:* `--spi-export-dir-dir` +
*Env:* `KC_SPI_EXPORT_DIR_DIR`
--



|any `+string+`

|
[.options-key]#``spi-export-dir-realm-name``# 

[.options-description]#Realm to export#

[#option-extended-spi-export-dir-realm-name,role="options-extended"]
--


*CLI:* `--spi-export-dir-realm-name` +
*Env:* `KC_SPI_EXPORT_DIR_REALM_NAME`
--



|any `+string+`

|
[.options-key]#``spi-export-dir-users-export-strategy``# 

[.options-description]#Users export strategy#

[#option-extended-spi-export-dir-users-export-strategy,role="options-extended"]
--


*CLI:* `--spi-export-dir-users-export-strategy` +
*Env:* `KC_SPI_EXPORT_DIR_USERS_EXPORT_STRATEGY`
--



|[.options-default]#`+DIFFERENT_FILES+`# (default) or any `+string+`

|
[.options-key]#``spi-export-dir-users-per-file``# 

[.options-description]#Users per exported file#

[#option-extended-spi-export-dir-users-per-file,role="options-extended"]
--


*CLI:* `--spi-export-dir-users-per-file` +
*Env:* `KC_SPI_EXPORT_DIR_USERS_PER_FILE`
--



|[.options-default]#`+50+`# (default) or any `+int+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-export-single-file-file``# 

[.options-description]#File to export to#

[#option-extended-spi-export-single-file-file,role="options-extended"]
--


*CLI:* `--spi-export-single-file-file` +
*Env:* `KC_SPI_EXPORT_SINGLE_FILE_FILE`
--



|any `+string+`

|
[.options-key]#``spi-export-single-file-realm-name``# 

[.options-description]#Realm to export#

[#option-extended-spi-export-single-file-realm-name,role="options-extended"]
--


*CLI:* `--spi-export-single-file-realm-name` +
*Env:* `KC_SPI_EXPORT_SINGLE_FILE_REALM_NAME`
--



|any `+string+`


|===
== group
=== jpa
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-group-jpa-escape-slashes-in-group-path``# 

[.options-description]#If true slashes `/` in group names are escaped with the character `~` when converted to paths.#

[#option-extended-spi-group-jpa-escape-slashes-in-group-path,role="options-extended"]
--


*CLI:* `--spi-group-jpa-escape-slashes-in-group-path` +
*Env:* `KC_SPI_GROUP_JPA_ESCAPE_SLASHES_IN_GROUP_PATH`
--



|
`+true+`, `+false+` (default)

|
[.options-key]#``spi-group-jpa-searchable-attributes``# 

[.options-description]#The list of attributes separated by comma that are allowed in client attribute searches.#

[#option-extended-spi-group-jpa-searchable-attributes,role="options-extended"]
--


*CLI:* `--spi-group-jpa-searchable-attributes` +
*Env:* `KC_SPI_GROUP_JPA_SEARCHABLE_ATTRIBUTES`
--



|any `+string+`


|===
== import
=== dir
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-import-dir-dir``# 

[.options-description]#Directory to import from#

[#option-extended-spi-import-dir-dir,role="options-extended"]
--


*CLI:* `--spi-import-dir-dir` +
*Env:* `KC_SPI_IMPORT_DIR_DIR`
--



|any `+string+`

|
[.options-key]#``spi-import-dir-realm-name``# 

[.options-description]#Realm to export#

[#option-extended-spi-import-dir-realm-name,role="options-extended"]
--


*CLI:* `--spi-import-dir-realm-name` +
*Env:* `KC_SPI_IMPORT_DIR_REALM_NAME`
--



|any `+string+`

|
[.options-key]#``spi-import-dir-strategy``# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended-spi-import-dir-strategy,role="options-extended"]
--


*CLI:* `--spi-import-dir-strategy` +
*Env:* `KC_SPI_IMPORT_DIR_STRATEGY`
--



|any `+string+`


|===
=== single-file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-import-single-file-file``# 

[.options-description]#File to import from#

[#option-extended-spi-import-single-file-file,role="options-extended"]
--


*CLI:* `--spi-import-single-file-file` +
*Env:* `KC_SPI_IMPORT_SINGLE_FILE_FILE`
--



|any `+string+`

|
[.options-key]#``spi-import-single-file-realm-name``# 

[.options-description]#Realm to export#

[#option-extended-spi-import-single-file-realm-name,role="options-extended"]
--


*CLI:* `--spi-import-single-file-realm-name` +
*Env:* `KC_SPI_IMPORT_SINGLE_FILE_REALM_NAME`
--



|any `+string+`

|
[.options-key]#``spi-import-single-file-strategy``# 

[.options-description]#Strategy for import: IGNORE_EXISTING, OVERWRITE_EXISTING#

[#option-extended-spi-import-single-file-strategy,role="options-extended"]
--


*CLI:* `--spi-import-single-file-strategy` +
*Env:* `KC_SPI_IMPORT_SINGLE_FILE_STRATEGY`
--



|any `+string+`


|===
== load-balancer-check
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-load-balancer-check-remote-poll-interval``# 

[.options-description]#The Remote caches poll interval, in milliseconds, for connection availability#

[#option-extended-spi-load-balancer-check-remote-poll-interval,role="options-extended"]
--


*CLI:* `--spi-load-balancer-check-remote-poll-interval` +
*Env:* `KC_SPI_LOAD_BALANCER_CHECK_REMOTE_POLL_INTERVAL`
--



|[.options-default]#`+5000+`# (default) or any `+int+`


|===
== login-failure
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-login-failure-remote-max-retries``# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended-spi-login-failure-remote-max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `--spi-login-failure-remote-max-retries` +
*Env:* `KC_SPI_LOGIN_FAILURE_REMOTE_MAX_RETRIES`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#``spi-login-failure-remote-retry-base-time``# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended-spi-login-failure-remote-retry-base-time,role="options-extended"]
--


*CLI:* `--spi-login-failure-remote-retry-base-time` +
*Env:* `KC_SPI_LOGIN_FAILURE_REMOTE_RETRY_BASE_TIME`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== password-hashing
=== argon2
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-password-hashing-argon2-cpu-cores``# 

[.options-description]#Maximum parallel CPU cores to use for hashing#

[#option-extended-spi-password-hashing-argon2-cpu-cores,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-cpu-cores` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_CPU_CORES`
--



|any `+int+`

|
[.options-key]#``spi-password-hashing-argon2-iterations``# 

[.options-description]#Iterations#

[#option-extended-spi-password-hashing-argon2-iterations,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-iterations` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_ITERATIONS`
--



|[.options-default]#`+5+`# (default) or any `+int+`

|
[.options-key]#``spi-password-hashing-argon2-memory``# 

[.options-description]#Memory size (KB)#

[#option-extended-spi-password-hashing-argon2-memory,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-memory` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_MEMORY`
--



|[.options-default]#`+7168+`# (default) or any `+int+`

|
[.options-key]#``spi-password-hashing-argon2-parallelism``# 

[.options-description]#Parallelism#

[#option-extended-spi-password-hashing-argon2-parallelism,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-parallelism` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_PARALLELISM`
--



|[.options-default]#`+1+`# (default) or any `+int+`

|
[.options-key]#``spi-password-hashing-argon2-type``# 

[.options-description]#Type#

[#option-extended-spi-password-hashing-argon2-type,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-type` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_TYPE`
--



|
`+id+` (default), `+d+`, `+i+`

|
[.options-key]#``spi-password-hashing-argon2-type``# 

[.options-description]#Hash length#

[#option-extended-spi-password-hashing-argon2-type,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-type` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_TYPE`
--



|[.options-default]#`+32+`# (default) or any `+int+`

|
[.options-key]#``spi-password-hashing-argon2-version``# 

[.options-description]#Version#

[#option-extended-spi-password-hashing-argon2-version,role="options-extended"]
--


*CLI:* `--spi-password-hashing-argon2-version` +
*Env:* `KC_SPI_PASSWORD_HASHING_ARGON2_VERSION`
--



|
`+1.3+` (default), `+1.0+`


|===
== public-key-storage
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-public-key-storage-infinispan-max-cache-time``# 

[.options-description]#Maximum interval in seconds that keys are cached when they are retrieved via all keys methods.#

[#option-extended-spi-public-key-storage-infinispan-max-cache-time,role="options-extended"]
--
[.options-description-extended]#When all keys for the entry are retrieved there is no way to detect if a key is missing (different to the case when the key is retrieved via ID for example). In that situation this option forces a refresh from time to time. Default 24 hours.#

*CLI:* `--spi-public-key-storage-infinispan-max-cache-time` +
*Env:* `KC_SPI_PUBLIC_KEY_STORAGE_INFINISPAN_MAX_CACHE_TIME`
--



|[.options-default]#`+86400+`# (default) or any `+int+`

|
[.options-key]#``spi-public-key-storage-infinispan-min-time-between-requests``# 

[.options-description]#Minimum interval in seconds between two requests to retrieve the new public keys.#

[#option-extended-spi-public-key-storage-infinispan-min-time-between-requests,role="options-extended"]
--
[.options-description-extended]#The server will always try to download new public keys when a single key is requested and not found. However it will avoid the download if the previous refresh was done less than 10 seconds ago (by default). This behavior is used to avoid DoS attacks against the external keys endpoint.#

*CLI:* `--spi-public-key-storage-infinispan-min-time-between-requests` +
*Env:* `KC_SPI_PUBLIC_KEY_STORAGE_INFINISPAN_MIN_TIME_BETWEEN_REQUESTS`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== required-action
=== UPDATE_PASSWORD
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-required-action-UPDATE_PASSWORD-max_auth_age``# 

[.options-description]#Configures the duration in seconds this action can be used after the last authentication before the user is required to re-authenticate.#

[#option-extended-spi-required-action-UPDATE_PASSWORD-max_auth_age,role="options-extended"]
--
[.options-description-extended]#This parameter is used just in the context of AIA when the kc_action parameter is available in the request, which is for instance when user himself updates his password in the account console. When the 'Maximum Authentication Age' password policy is used in the realm, it's value has precedence over the value configured here.#

*CLI:* `--spi-required-action-UPDATE_PASSWORD-max_auth_age` +
*Env:* `KC_SPI_REQUIRED_ACTION_UPDATE_PASSWORD_MAX_AUTH_AGE`
--



|[.options-default]#`+300+`# (default) or any `+String+`


|===
== resource-encoding
=== gzip
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-resource-encoding-gzip-excluded-content-types``# 

[.options-description]#A space separated list of content-types to exclude from encoding.#

[#option-extended-spi-resource-encoding-gzip-excluded-content-types,role="options-extended"]
--


*CLI:* `--spi-resource-encoding-gzip-excluded-content-types` +
*Env:* `KC_SPI_RESOURCE_ENCODING_GZIP_EXCLUDED_CONTENT_TYPES`
--



|[.options-default]#`+image/png image/jpeg+`# (default) or any `+string+`


|===
== security-profile
=== default
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-security-profile-default-name``# 

[.options-description]#Name for the security configuration file to use.#

[#option-extended-spi-security-profile-default-name,role="options-extended"]
--
[.options-description-extended]#File `name`.json is searched in classapth and `conf` installation folder.#

*CLI:* `--spi-security-profile-default-name` +
*Env:* `KC_SPI_SECURITY_PROFILE_DEFAULT_NAME`
--



|any `+string+`


|===
== single-use-object
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-single-use-object-infinispan-persist-revoked-tokens``# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended-spi-single-use-object-infinispan-persist-revoked-tokens,role="options-extended"]
--


*CLI:* `--spi-single-use-object-infinispan-persist-revoked-tokens` +
*Env:* `KC_SPI_SINGLE_USE_OBJECT_INFINISPAN_PERSIST_REVOKED_TOKENS`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-single-use-object-remote-persist-revoked-tokens``# 

[.options-description]#If revoked tokens are stored persistently across restarts#

[#option-extended-spi-single-use-object-remote-persist-revoked-tokens,role="options-extended"]
--


*CLI:* `--spi-single-use-object-remote-persist-revoked-tokens` +
*Env:* `KC_SPI_SINGLE_USE_OBJECT_REMOTE_PERSIST_REVOKED_TOKENS`
--



|
`+true+` (default), `+false+`


|===
== sticky-session-encoder
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-sticky-session-encoder-infinispan-should-attach-route``# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended-spi-sticky-session-encoder-infinispan-should-attach-route,role="options-extended"]
--


*CLI:* `--spi-sticky-session-encoder-infinispan-should-attach-route` +
*Env:* `KC_SPI_STICKY_SESSION_ENCODER_INFINISPAN_SHOULD_ATTACH_ROUTE`
--



|
`+true+` (default), `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-sticky-session-encoder-remote-should-attach-route``# 

[.options-description]#If the route should be attached to cookies to reflect the node that owns a particular session.#

[#option-extended-spi-sticky-session-encoder-remote-should-attach-route,role="options-extended"]
--


*CLI:* `--spi-sticky-session-encoder-remote-should-attach-route` +
*Env:* `KC_SPI_STICKY_SESSION_ENCODER_REMOTE_SHOULD_ATTACH_ROUTE`
--



|
`+true+` (default), `+false+`


|===
== truststore
=== file
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-truststore-file-file``# 

[.options-description]#DEPRECATED: The file path of the trust store from where the certificates are going to be read from to validate TLS connections.#

[#option-extended-spi-truststore-file-file,role="options-extended"]
--


*CLI:* `--spi-truststore-file-file` +
*Env:* `KC_SPI_TRUSTSTORE_FILE_FILE`
--



|any `+string+`

|
[.options-key]#``spi-truststore-file-hostname-verification-policy``# 

[.options-description]#DEPRECATED: The hostname verification policy.#

[#option-extended-spi-truststore-file-hostname-verification-policy,role="options-extended"]
--


*CLI:* `--spi-truststore-file-hostname-verification-policy` +
*Env:* `KC_SPI_TRUSTSTORE_FILE_HOSTNAME_VERIFICATION_POLICY`
--



|
`+ANY+`, `+WILDCARD+`, `+STRICT+`, `+DEFAULT+` (default)

|
[.options-key]#``spi-truststore-file-password``# 

[.options-description]#DEPRECATED: The trust store password.#

[#option-extended-spi-truststore-file-password,role="options-extended"]
--


*CLI:* `--spi-truststore-file-password` +
*Env:* `KC_SPI_TRUSTSTORE_FILE_PASSWORD`
--



|any `+string+`

|
[.options-key]#``spi-truststore-file-type``# 

[.options-description]#DEPRECATED: Type of the truststore.#

[#option-extended-spi-truststore-file-type,role="options-extended"]
--
[.options-description-extended]#If not provided, the type would be detected based on the truststore file extension or platform default type.#

*CLI:* `--spi-truststore-file-type` +
*Env:* `KC_SPI_TRUSTSTORE_FILE_TYPE`
--



|any `+string+`


|===
== user-profile
=== declarative-user-profile
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-user-profile-declarative-user-profile-admin-read-only-attributes``# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so administrators can't change them.#

[#option-extended-spi-user-profile-declarative-user-profile-admin-read-only-attributes,role="options-extended"]
--


*CLI:* `--spi-user-profile-declarative-user-profile-admin-read-only-attributes` +
*Env:* `KC_SPI_USER_PROFILE_DECLARATIVE_USER_PROFILE_ADMIN_READ_ONLY_ATTRIBUTES`
--



|any `+MultivaluedString+`

|
[.options-key]#``spi-user-profile-declarative-user-profile-max-email-local-part-length``# 

[.options-description]#To set user profile max email local part length#

[#option-extended-spi-user-profile-declarative-user-profile-max-email-local-part-length,role="options-extended"]
--


*CLI:* `--spi-user-profile-declarative-user-profile-max-email-local-part-length` +
*Env:* `KC_SPI_USER_PROFILE_DECLARATIVE_USER_PROFILE_MAX_EMAIL_LOCAL_PART_LENGTH`
--



|any `+String+`

|
[.options-key]#``spi-user-profile-declarative-user-profile-read-only-attributes``# 

[.options-description]#Array of regular expressions to identify fields that should be treated read-only so users can't change them.#

[#option-extended-spi-user-profile-declarative-user-profile-read-only-attributes,role="options-extended"]
--


*CLI:* `--spi-user-profile-declarative-user-profile-read-only-attributes` +
*Env:* `KC_SPI_USER_PROFILE_DECLARATIVE_USER_PROFILE_READ_ONLY_ATTRIBUTES`
--



|any `+MultivaluedString+`


|===
== user-sessions
=== infinispan
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-user-sessions-infinispan-max-batch-size``# 

[.options-description]#Maximum size of a batch size (only applicable to persistent sessions#

[#option-extended-spi-user-sessions-infinispan-max-batch-size,role="options-extended"]
--


*CLI:* `--spi-user-sessions-infinispan-max-batch-size` +
*Env:* `KC_SPI_USER_SESSIONS_INFINISPAN_MAX_BATCH_SIZE`
--



|[.options-default]#`+4+`# (default) or any `+int+`

|
[.options-key]#``spi-user-sessions-infinispan-offline-client-session-cache-entry-lifespan-override``# 

[.options-description]#Override how long offline client sessions should be kept in memory#

[#option-extended-spi-user-sessions-infinispan-offline-client-session-cache-entry-lifespan-override,role="options-extended"]
--


*CLI:* `--spi-user-sessions-infinispan-offline-client-session-cache-entry-lifespan-override` +
*Env:* `KC_SPI_USER_SESSIONS_INFINISPAN_OFFLINE_CLIENT_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE`
--



|any `+int+`

|
[.options-key]#``spi-user-sessions-infinispan-offline-session-cache-entry-lifespan-override``# 

[.options-description]#Override how long offline user sessions should be kept in memory#

[#option-extended-spi-user-sessions-infinispan-offline-session-cache-entry-lifespan-override,role="options-extended"]
--


*CLI:* `--spi-user-sessions-infinispan-offline-session-cache-entry-lifespan-override` +
*Env:* `KC_SPI_USER_SESSIONS_INFINISPAN_OFFLINE_SESSION_CACHE_ENTRY_LIFESPAN_OVERRIDE`
--



|any `+int+`

|
[.options-key]#``spi-user-sessions-infinispan-use-caches``# 

[.options-description]#Enable or disable caches.#

[#option-extended-spi-user-sessions-infinispan-use-caches,role="options-extended"]
--
[.options-description-extended]#Enabled by default unless the external feature to use only external remote caches is used#

*CLI:* `--spi-user-sessions-infinispan-use-caches` +
*Env:* `KC_SPI_USER_SESSIONS_INFINISPAN_USE_CACHES`
--



|
`+true+`, `+false+`


|===
=== remote
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-user-sessions-remote-batch-size``# 

[.options-description]#Batch size when streaming session from the remote cache#

[#option-extended-spi-user-sessions-remote-batch-size,role="options-extended"]
--


*CLI:* `--spi-user-sessions-remote-batch-size` +
*Env:* `KC_SPI_USER_SESSIONS_REMOTE_BATCH_SIZE`
--



|[.options-default]#`+1024+`# (default) or any `+int+`

|
[.options-key]#``spi-user-sessions-remote-max-retries``# 

[.options-description]#The maximum number of retries if an error occurs.#

[#option-extended-spi-user-sessions-remote-max-retries,role="options-extended"]
--
[.options-description-extended]#A value of zero or less disable any retries.#

*CLI:* `--spi-user-sessions-remote-max-retries` +
*Env:* `KC_SPI_USER_SESSIONS_REMOTE_MAX_RETRIES`
--



|[.options-default]#`+10+`# (default) or any `+int+`

|
[.options-key]#``spi-user-sessions-remote-retry-base-time``# 

[.options-description]#The base back-off time in milliseconds.#

[#option-extended-spi-user-sessions-remote-retry-base-time,role="options-extended"]
--


*CLI:* `--spi-user-sessions-remote-retry-base-time` +
*Env:* `KC_SPI_USER_SESSIONS_REMOTE_RETRY_BASE_TIME`
--



|[.options-default]#`+10+`# (default) or any `+int+`


|===
== well-known
=== oauth-authorization-server
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-well-known-oauth-authorization-server-include-client-scopes``# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended-spi-well-known-oauth-authorization-server-include-client-scopes,role="options-extended"]
--


*CLI:* `--spi-well-known-oauth-authorization-server-include-client-scopes` +
*Env:* `KC_SPI_WELL_KNOWN_OAUTH_AUTHORIZATION_SERVER_INCLUDE_CLIENT_SCOPES`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-well-known-oauth-authorization-server-openid-configuration-override``# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended-spi-well-known-oauth-authorization-server-openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#

*CLI:* `--spi-well-known-oauth-authorization-server-openid-configuration-override` +
*Env:* `KC_SPI_WELL_KNOWN_OAUTH_AUTHORIZATION_SERVER_OPENID_CONFIGURATION_OVERRIDE`
--



|any `+string+`


|===
=== openid-configuration
[cols="12a,4",role="options"]
|===
| |Value

|
[.options-key]#``spi-well-known-openid-configuration-include-client-scopes``# 

[.options-description]#If client scopes should be used to calculate the list of supported scopes.#

[#option-extended-spi-well-known-openid-configuration-include-client-scopes,role="options-extended"]
--


*CLI:* `--spi-well-known-openid-configuration-include-client-scopes` +
*Env:* `KC_SPI_WELL_KNOWN_OPENID_CONFIGURATION_INCLUDE_CLIENT_SCOPES`
--



|
`+true+` (default), `+false+`

|
[.options-key]#``spi-well-known-openid-configuration-openid-configuration-override``# 

[.options-description]#The file path from where the metadata should be loaded from.#

[#option-extended-spi-well-known-openid-configuration-openid-configuration-override,role="options-extended"]
--
[.options-description-extended]#You can use an absolute file path or, if the file is in the server classpath, use the `classpath:` prefix to load the file from the classpath.#

*CLI:* `--spi-well-known-openid-configuration-openid-configuration-override` +
*Env:* `KC_SPI_WELL_KNOWN_OPENID_CONFIGURATION_OPENID_CONFIGURATION_OVERRIDE`
--



|any `+string+`


|===


