han-app/codebase/backend/keycloak/realm/han-chat-realm.json

{
  "realm": "han-chat",
  "enabled": true,
  "displayName": "HAN Chat",
  "registrationAllowed": false,
  "registrationEmailAsUsername": false,
  "resetPasswordAllowed": false,
  "editUsernameAllowed": false,
  "loginWithEmailAllowed": false,
  "duplicateEmailsAllowed": false,
  "verifyEmail": false,
  "rememberMe": true,
  "sslRequired": "external",
  "defaultSignatureAlgorithm": "RS256",
  "accessTokenLifespan": 300,
  "accessCodeLifespan": 60,
  "accessCodeLifespanLogin": 300,
  "ssoSessionIdleTimeout": 2592000,
  "ssoSessionMaxLifespan": 7776000,
  "clientSessionIdleTimeout": 2592000,
  "clientSessionMaxLifespan": 7776000,
  "revokeRefreshToken": true,
  "refreshTokenMaxReuse": 0,
  "offlineSessionMaxLifespanEnabled": true,
  "offlineSessionMaxLifespan": 0,
  "bruteForceProtected": true,
  "permanentLockout": false,
  "maxTemporaryLockouts": 0,
  "failureFactor": 5,
  "waitIncrementSeconds": 60,
  "quickLoginCheckMilliSeconds": 1000,
  "minimumQuickLoginWaitSeconds": 60,
  "maxFailureWaitSeconds": 900,
  "maxDeltaTimeSeconds": 43200,
  "eventsEnabled": true,
  "eventsExpiration": 7776000,
  "enabledEventTypes": [
    "LOGIN", "LOGIN_ERROR", "LOGOUT", "LOGOUT_ERROR",
    "REFRESH_TOKEN", "REFRESH_TOKEN_ERROR", "REVOKE_GRANT", "REVOKE_GRANT_ERROR"
  ],
  "adminEventsEnabled": true,
  "adminEventsDetailsEnabled": false,
  "internationalizationEnabled": true,
  "supportedLocales": ["ru"],
  "defaultLocale": "ru",
  "loginTheme": "han-phone",
  "browserFlow": "han-phone-otp-browser",
  "clients": [
    {
      "clientId": "han-chat-frontend",
      "name": "HAN Chat Frontend",
      "enabled": true,
      "publicClient": true,
      "clientAuthenticatorType": "client-secret",
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
      "authorizationServicesEnabled": false,
      "frontchannelLogout": true,
      "fullScopeAllowed": false,
      "redirectUris": [
        "https://tohin.ru/auth/callback",
        "han-chat://auth/callback",
        "https://APP_LINK_HOST.example/auth/callback"
      ],
      "webOrigins": [
        "https://tohin.ru",
        "https://APP_WEB_ORIGIN.example"
      ],
      "attributes": {
        "pkce.code.challenge.method": "S256",
        "post.logout.redirect.uris": "https://tohin.ru/##han-chat://auth/logout##https://APP_LINK_HOST.example/auth/logout",
        "oauth2.device.authorization.grant.enabled": "false",
        "oidc.ciba.grant.enabled": "false",
        "use.refresh.tokens": "true",
        "client.use.lightweight.access.token.enabled": "false"
      },
      "defaultClientScopes": ["openid", "profile", "phone", "han-chat-api"],
      "optionalClientScopes": ["offline_access"]
    }
  ],
  "clientScopes": [
    {
      "name": "phone",
      "description": "Verified E.164 phone claims",
      "protocol": "openid-connect",
      "attributes": {
        "include.in.token.scope": "true",
        "display.on.consent.screen": "false"
      },
      "protocolMappers": [
        {
          "name": "phone number",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-attribute-mapper",
          "consentRequired": false,
          "config": {
            "user.attribute": "phone_number",
            "claim.name": "phone_number",
            "jsonType.label": "String",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "userinfo.token.claim": "true"
          }
        },
        {
          "name": "phone verified",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-attribute-mapper",
          "consentRequired": false,
          "config": {
            "user.attribute": "phone_number_verified",
            "claim.name": "phone_number_verified",
            "jsonType.label": "boolean",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "userinfo.token.claim": "true"
          }
        }
      ]
    },
    {
      "name": "han-chat-api",
      "description": "HAN Chat API audience",
      "protocol": "openid-connect",
      "attributes": {
        "include.in.token.scope": "false",
        "display.on.consent.screen": "false"
      },
      "protocolMappers": [
        {
          "name": "han-chat-api audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "consentRequired": false,
          "config": {
            "included.client.audience": "han-chat-api",
            "id.token.claim": "false",
            "access.token.claim": "true"
          }
        }
      ]
    }
  ],
  "authenticationFlows": [
    {
      "alias": "han-phone-otp-browser",
      "description": "Cookie SSO or phone OTP only",
      "providerId": "basic-flow",
      "topLevel": true,
      "builtIn": false,
      "authenticationExecutions": [
        {
          "authenticator": "auth-cookie",
          "requirement": "ALTERNATIVE",
          "priority": 10,
          "authenticatorFlow": false
        },
        {
          "flowAlias": "han-phone-otp-forms",
          "requirement": "ALTERNATIVE",
          "priority": 20,
          "authenticatorFlow": true
        }
      ]
    },
    {
      "alias": "han-phone-otp-forms",
      "description": "Normalize phone, reserve challenge and verify OTP",
      "providerId": "basic-flow",
      "topLevel": false,
      "builtIn": false,
      "authenticationExecutions": [
        {
          "authenticator": "han-phone-identity",
          "requirement": "REQUIRED",
          "priority": 10,
          "authenticatorFlow": false
        },
        {
          "authenticator": "han-phone-otp",
          "requirement": "REQUIRED",
          "priority": 20,
          "authenticatorFlow": false
        }
      ]
    }
  ],
  "requiredActions": [],
  "components": {
    "org.keycloak.keys.KeyProvider": [
      {
        "name": "rsa-generated",
        "providerId": "rsa-generated",
        "subType": "rsa-generated",
        "config": {
          "priority": ["100"],
          "algorithm": ["RS256"],
          "keySize": ["2048"]
        }
      }
    ]
  }
}