Keycloak Realms

length(8) and digits(1) and upperCase(1) and specialChars(1) and notUsername

CREATE TABLE REALM (
    ID                              VARCHAR(36) PRIMARY KEY,
    NAME                            VARCHAR(255) UNIQUE NOT NULL,
    ENABLED                         BOOLEAN DEFAULT FALSE,
    SSL_REQUIRED                    VARCHAR(255),

    -- Registration & Login
    REGISTRATION_ALLOWED            BOOLEAN DEFAULT FALSE,
    REG_EMAIL_AS_USERNAME           BOOLEAN DEFAULT FALSE,
    VERIFY_EMAIL                    BOOLEAN DEFAULT FALSE,
    RESET_PASSWORD_ALLOWED          BOOLEAN DEFAULT FALSE,
    LOGIN_WITH_EMAIL_ALLOWED        BOOLEAN DEFAULT TRUE,
    DUPLICATE_EMAILS_ALLOWED        BOOLEAN DEFAULT FALSE,
    REMEMBER_ME                     BOOLEAN DEFAULT FALSE,
    EDIT_USERNAME_ALLOWED           BOOLEAN DEFAULT FALSE,

    -- Session Timeouts
    SSO_IDLE_TIMEOUT                INT DEFAULT 1800,
    SSO_MAX_LIFESPAN                INT DEFAULT 36000,
    SSO_IDLE_TIMEOUT_REMEMBER_ME    INT DEFAULT 0,
    SSO_MAX_LIFESPAN_REMEMBER_ME    INT DEFAULT 0,
    OFFLINE_SESSION_IDLE_TIMEOUT    INT DEFAULT 2592000,

    -- Token Lifespans
    ACCESS_TOKEN_LIFESPAN           INT DEFAULT 300,
    ACCESS_TOKEN_LIFE_IMPLICIT      INT DEFAULT 900,
    ACCESS_CODE_LIFESPAN            INT DEFAULT 60,
    USER_ACTION_LIFESPAN            INT DEFAULT 300,
    LOGIN_LIFESPAN                  INT DEFAULT 1800,

    -- Token Settings
    NOT_BEFORE                      INT DEFAULT 0,
    REVOKE_REFRESH_TOKEN            BOOLEAN DEFAULT FALSE,
    REFRESH_TOKEN_MAX_REUSE         INT DEFAULT 0,

    -- Themes
    LOGIN_THEME                     VARCHAR(255),
    ACCOUNT_THEME                   VARCHAR(255),
    ADMIN_THEME                     VARCHAR(255),
    EMAIL_THEME                     VARCHAR(255),

    -- Events
    EVENTS_ENABLED                  BOOLEAN DEFAULT FALSE,
    EVENTS_EXPIRATION               BIGINT DEFAULT 0,
    ADMIN_EVENTS_ENABLED            BOOLEAN DEFAULT FALSE,
    ADMIN_EVENTS_DETAILS_ENABLED    BOOLEAN DEFAULT FALSE,

    -- Policies
    PASSWORD_POLICY                 VARCHAR(2550),
    OTP_POLICY_TYPE                 VARCHAR(255) DEFAULT 'totp',
    OTP_POLICY_ALG                  VARCHAR(255) DEFAULT 'HmacSHA1',
    OTP_POLICY_DIGITS               INT DEFAULT 6,
    OTP_POLICY_PERIOD               INT DEFAULT 30,
    OTP_POLICY_WINDOW               INT DEFAULT 1,
    OTP_POLICY_COUNTER              INT DEFAULT 0,

    -- Authentication Flows (Foreign Keys)
    BROWSER_FLOW                    VARCHAR(36),
    REGISTRATION_FLOW               VARCHAR(36),
    DIRECT_GRANT_FLOW               VARCHAR(36),
    RESET_CREDENTIALS_FLOW          VARCHAR(36),
    CLIENT_AUTH_FLOW                VARCHAR(36),
    DOCKER_AUTH_FLOW                VARCHAR(36),

    -- Administrative
    MASTER_ADMIN_CLIENT             VARCHAR(36),
    DEFAULT_ROLE                    VARCHAR(36),

    -- Features
    INTERNATIONALIZATION_ENABLED    BOOLEAN DEFAULT FALSE,
    DEFAULT_LOCALE                  VARCHAR(255),
    ALLOW_USER_MANAGED_ACCESS       BOOLEAN DEFAULT FALSE
);

-- Realm Custom Attributes
CREATE TABLE REALM_ATTRIBUTE (
    REALM_ID    VARCHAR(36) NOT NULL,
    NAME        VARCHAR(255) NOT NULL,
    VALUE       TEXT,
    PRIMARY KEY (REALM_ID, NAME),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- SMTP Configuration
CREATE TABLE REALM_SMTP_CONFIG (
    REALM_ID    VARCHAR(36) NOT NULL,
    NAME        VARCHAR(255) NOT NULL,
    VALUE       VARCHAR(1024),
    PRIMARY KEY (REALM_ID, NAME),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- Default Groups (assigned to new users)
CREATE TABLE REALM_DEFAULT_GROUPS (
    REALM_ID    VARCHAR(36) NOT NULL,
    GROUP_ID    VARCHAR(36) NOT NULL,
    PRIMARY KEY (REALM_ID, GROUP_ID),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- Supported Locales
CREATE TABLE REALM_SUPPORTED_LOCALES (
    REALM_ID    VARCHAR(36) NOT NULL,
    VALUE       VARCHAR(255) NOT NULL,
    PRIMARY KEY (REALM_ID, VALUE),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- Event Listeners
CREATE TABLE REALM_EVENTS_LISTENERS (
    REALM_ID    VARCHAR(36) NOT NULL,
    VALUE       VARCHAR(255) NOT NULL,
    PRIMARY KEY (REALM_ID, VALUE),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- Enabled Event Types
CREATE TABLE REALM_ENABLED_EVENT_TYPES (
    REALM_ID    VARCHAR(36) NOT NULL,
    VALUE       VARCHAR(255) NOT NULL,
    PRIMARY KEY (REALM_ID, VALUE),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

-- Localization Texts
CREATE TABLE REALM_LOCALIZATION_TEXTS (
    REALM_ID    VARCHAR(36) NOT NULL,
    LOCALE      VARCHAR(255) NOT NULL,
    KEY         VARCHAR(255) NOT NULL,
    VALUE       TEXT,
    PRIMARY KEY (REALM_ID, LOCALE, KEY),
    FOREIGN KEY (REALM_ID) REFERENCES REALM(ID) ON DELETE CASCADE
);

// From RealmManager.setupRealmDefaults()
realm.setBrowserSecurityHeaders(BrowserSecurityHeaders.realmDefaultHeaders);
realm.setBruteForceProtected(false);
realm.setPermanentLockout(false);
realm.setMaxFailureWaitSeconds(900);      // 15 minutes
realm.setMinimumQuickLoginWaitSeconds(60); // 1 minute
realm.setWaitIncrementSeconds(60);
realm.setQuickLoginCheckMilliSeconds(1000);
realm.setMaxDeltaTimeSeconds(43200);       // 12 hours
realm.setFailureFactor(30);
realm.setSslRequired(SslRequired.EXTERNAL);
realm.setOTPPolicy(OTPPolicy.DEFAULT_POLICY);
realm.setLoginWithEmailAllowed(true);
realm.setEventsListeners(Collections.singleton("jboss-logging"));

public interface RealmProvider extends Provider {
    // Create
    RealmModel createRealm(String name);
    RealmModel createRealm(String id, String name);

    // Read
    RealmModel getRealm(String id);
    RealmModel getRealmByName(String name);
    Stream<realmmodel> getRealmsStream();
    Stream<realmmodel> getRealmsStream(String search);
    Stream<realmmodel> getRealmsWithProviderTypeStream(Class<? > type);

    // Delete
    boolean removeRealm(String id);

    // Client Initial Access
    ClientInitialAccessModel createClientInitialAccessModel(...);
    ClientInitialAccessModel getClientInitialAccessModel(...);
    void removeClientInitialAccessModel(...);
    Stream<clientinitialaccessmodel> listClientInitialAccessStream(...);

    // Localization
    void saveLocalizationText(RealmModel realm, String locale, String key, String text);
    void saveLocalizationTexts(RealmModel realm, String locale, Map<string, string=""> texts);
    boolean deleteLocalizationTextsByLocale(RealmModel realm, String locale);
}
</string,>

realm.isUserManagedAccessAllowed()  // Enable UMA permissions
realm.setUserManagedAccessAllowed(boolean)

realm.isOrganizationsEnabled()  // Enable organizations feature
realm.setOrganizationsEnabled(boolean)

realm.isVerifiableCredentialsEnabled()  // Enable OID4VC support
realm.setVerifiableCredentialsEnabled(boolean)

realm.isAdminPermissionsEnabled()  // Enable fine-grained admin permissions
realm.setAdminPermissionsEnabled(boolean)
realm.getAdminPermissionsClient()  // Get the admin permissions client

// Default Clients
ADMIN_CONSOLE_CLIENT_ID = "security-admin-console"
ADMIN_CLI_CLIENT_ID = "admin-cli"
ACCOUNT_MANAGEMENT_CLIENT_ID = "account"
ACCOUNT_CONSOLE_CLIENT_ID = "account-console"
BROKER_SERVICE_CLIENT_ID = "broker"
REALM_MANAGEMENT_CLIENT_ID = "realm-management"

// Default Roles
OFFLINE_ACCESS_ROLE = "offline_access"
DEFAULT_ROLES_ROLE_PREFIX = "default-roles"

// Token Lifespans (seconds)
DEFAULT_ACCESS_TOKEN_LIFESPAN_FOR_IMPLICIT_FLOW_TIMEOUT = 900   // 15 min
DEFAULT_OFFLINE_SESSION_IDLE_TIMEOUT = 2592000                  // 30 days
DEFAULT_OFFLINE_SESSION_MAX_LIFESPAN = 5184000                  // 60 days
DEFAULT_SESSION_IDLE_TIMEOUT = 1800                             // 30 min
DEFAULT_SESSION_MAX_LIFESPAN = 36000                            // 10 hours

// Signature Algorithms
DEFAULT_SIGNATURE_ALGORITHM = "RS256"
INTERNAL_SIGNATURE_ALGORITHM = "HS512"