{
  "realm": "mischlabs",
  "enabled": true,
  "displayName": "MischLabs",
  "displayNameHtml": "<strong>Misch</strong>Labs",
  "sslRequired": "external",
  "registrationAllowed": false,
  "registrationEmailAsUsername": false,
  "loginWithEmailAllowed": true,
  "duplicateEmailsAllowed": false,
  "resetPasswordAllowed": true,
  "editUsernameAllowed": false,
  "bruteForceProtected": true,
  "permanentLockout": false,
  "maxFailureWaitSeconds": 900,
  "maxDeltaTimeSeconds": 43200,
  "failureFactor": 5,
  "accessTokenLifespan": 300,
  "ssoSessionIdleTimeout": 2592000,
  "ssoSessionMaxLifespan": 7776000,
  "ssoSessionIdleTimeoutRememberMe": 2592000,
  "ssoSessionMaxLifespanRememberMe": 7776000,
  "offlineSessionIdleTimeout": 7776000,
  "offlineSessionMaxLifespan": 15552000,
  "offlineSessionMaxLifespanEnabled": true,
  "roles": {
    "realm": [
      {
        "name": "user",
        "description": "Standard MischLabs user"
      },
      {
        "name": "admin",
        "description": "MischLabs administrator"
      }
    ]
  },
  "defaultRoles": ["user"],
  "clients": [
    {
      "clientId": "gitea",
      "name": "Gitea",
      "description": "Code-Repositories (git.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
      "redirectUris": [
        "https://git.mischlabs.de/*"
      ],
      "webOrigins": ["https://git.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "nextcloud",
      "name": "Nextcloud",
      "description": "Cloud-Speicher (drive.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://drive.mischlabs.de/apps/oidc_login/oidc",
        "https://drive.mischlabs.de/apps/user_oidc/code"
      ],
      "webOrigins": ["https://drive.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"],
      "attributes": {
        "pkce.code.challenge.method": "S256",
        "id.token.signed.response.alg": "RS256"
      }
    },
    {
      "clientId": "mealie",
      "name": "Mealie",
      "description": "Rezepte (foodlabs.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://foodlabs.mischlabs.de/*"
      ],
      "webOrigins": ["https://foodlabs.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email", "groups"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "audiobookshelf",
      "name": "Audiobookshelf",
      "description": "Hoerbuecher (audiobook.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://audiobook.mischlabs.de/auth/openid/callback",
        "https://audiobook.mischlabs.de/auth/openid/mobile-redirect"
      ],
      "webOrigins": ["https://audiobook.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"],
      "attributes": {
        "user.info.response.signature.alg": ""
      }
    },
    {
      "clientId": "jellyfin",
      "name": "Jellyfin",
      "description": "Filme & Serien (movies.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://movies.mischlabs.de/*"
      ],
      "webOrigins": ["https://movies.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "vaultwarden",
      "name": "Vaultwarden",
      "description": "Passwort-Manager (password.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://password.mischlabs.de/identity/connect/oidc-signin"
      ],
      "webOrigins": ["https://password.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "pocketbase",
      "name": "PocketBase",
      "description": "Persoenliche Seite (tom.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://tom.mischlabs.de/api/oauth2-redirect",
        "https://tom.mischlabs.de/_/*"
      ],
      "webOrigins": ["https://tom.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "docs",
      "name": "Docs",
      "description": "Dokumentation (docs.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://docs.mischlabs.de/*"
      ],
      "webOrigins": ["https://docs.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "michess",
      "name": "MiChess",
      "description": "Schach (michess.mischlabs.de)",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://michess.mischlabs.de/*"
      ],
      "webOrigins": ["https://michess.mischlabs.de"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    },
    {
      "clientId": "cloudflare-access",
      "name": "Cloudflare Access",
      "description": "Cloudflare Zero Trust als Schutzschicht",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "standardFlowEnabled": true,
      "directAccessGrantsEnabled": false,
      "redirectUris": [
        "https://*.cloudflareaccess.com/cdn-cgi/access/callback"
      ],
      "webOrigins": ["+"],
      "defaultClientScopes": ["openid", "profile", "email"],
      "optionalClientScopes": ["offline_access"]
    }
  ],
  "clientScopes": [
    {
      "name": "groups",
      "description": "User group memberships",
      "protocol": "openid-connect",
      "protocolMappers": [
        {
          "name": "groups",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-group-membership-mapper",
          "config": {
            "full.path": "false",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "claim.name": "groups",
            "userinfo.token.claim": "true"
          }
        }
      ]
    }
  ],
  "smtpServer": {},
  "loginTheme": "keycloak",
  "accountTheme": "keycloak.v3",
  "internationalizationEnabled": true,
  "supportedLocales": ["de", "en"],
  "defaultLocale": "de"
}