string Authority { get; }
Source
Gets the local Keycloak realm authority.
Keycloak
AppSurfaceKeycloakReadinessResult
SourceCaptures safe readiness evidence for the AppSurface Keycloak local proof.
Parameters
AuthorityThe verified Keycloak realm authority.ClientIdThe verified public client id.RealmThe verified realm id.
AppSurfaceKeycloakConfigurationProjection
SourceSecret-safe app configuration produced by the AppSurface Keycloak proof package.
Remarks
The projection only contains OIDC authority, client id, callback paths, and the public-client secret policy. It never contains admin credentials, seeded user passwords, realm JSON, tokens, raw claims, or client secrets.
ApplyTo
IResourceBuilder<ProjectResource> ApplyTo(IResourceBuilder<ProjectResource> project)
Source
Applies the allowlisted environment variables to an Aspire project resource.
Parameters
projectThe project resource builder.
Returns
The same project resource builder for chaining.
Authority
ClientId
string ClientId { get; }
Source
Gets the local public client id.
CallbackPath
string CallbackPath { get; }
Source
Gets the OIDC callback path.
SignedOutCallbackPath
string SignedOutCallbackPath { get; }
Source
Gets the OIDC signed-out callback path.
RequireClientSecret
bool RequireClientSecret { get; }
Source
Gets a value indicating whether the paired proof app should require a client secret.
EnvironmentVariables
IReadOnlyDictionary<string, string> EnvironmentVariables { get; }
Source
Gets the allowlisted environment variables used by the proof web app.
AppSurfaceKeycloakRealmReadyEnvironment
SourceDefines the nonsecret environment contract for the package-owned realm-ready executable.
AppSurfaceKeycloakLocalSeed
SourceIdentifies one registered finite consumer project in an AppSurface local Keycloak seed chain.
Name
string Name { get; }
Source
Gets the caller-supplied stage name.
Resource
IResourceBuilder<ProjectResource> Resource { get; }
Source
Gets the consumer-owned finite project resource.
Remarks
Applications may make their own resources wait for this completion handle, but the normal next seed should be registered through AppSurfaceKeycloakResource.WithLocalSeed with AppSurfaceKeycloakLocalSeedOptions.After so the package can validate the linear chain.
AppSurfaceKeycloakResource
SourceWraps the official Aspire Keycloak resource with AppSurface local proof metadata.
RealmReady
AppSurfaceKeycloakRealmReady RealmReady()
Source
Gets the lazily registered finite resource that proves the local Keycloak realm baseline is ready.
Returns
A cached completion-bearing resource that consumers can use as the first dependency for local seed projects.
Exceptions
AppSurfaceKeycloakExceptionThe wrapper was not created byAddAppSurfaceKeycloak(...)or the package-owned worker cannot be resolved.
Remarks
The returned resource waits for the official Keycloak resource to become healthy, then performs the package's bounded metadata, generated-realm, and public authorization-challenge checks in a separate finite process. It performs no Keycloak administration and receives no credentials. Calling this method repeatedly for the same wrapper returns the same resource and never adds a second gate to the AppHost graph.
WithLocalSeed
AppSurfaceKeycloakLocalSeed WithLocalSeed(string name, Func<AppSurfaceKeycloakLocalSeedContext, IResourceBuilder<ProjectResource>> factory, Action<AppSurfaceKeycloakLocalSeedOptions>? configure = null)
Source
Registers one finite, consumer-owned project that seeds local Keycloak-adjacent state after baseline realm readiness.
Parameters
nameA unique lower-case local seed stage name.factoryCreates exactly one finite AspireProjectResourceusing the supplied safe context.configureOptional local-only ordering, environment-policy, and typed-secret configuration.
Returns
The registered local seed handle, including its consumer-owned project resource.
Exceptions
AppSurfaceKeycloakExceptionLocal policy, ordering, factory, or secret-binding validation fails.
Remarks
Registration is permitted only while the AppHost executes Run in Development, Test, or Testing by default. The first seed waits for RealmReady. Each later seed must nominate the immediately previous handle via AppSurfaceKeycloakLocalSeedOptions.After; this intentionally creates one linear, observable completion chain. The package never starts a callback runner or performs Keycloak administration. The factory owns the actual client, mutation, retry, idempotence, and finite exit code.
Resource
IResourceBuilder<KeycloakResource> Resource { get; }
Source
Gets the underlying Aspire Keycloak resource builder for normal Aspire APIs such as WithReference and WaitFor.
Configuration
AppSurfaceKeycloakConfigurationProjection Configuration { get; }
Source
Gets the secret-safe web configuration projection.
Readiness
AppSurfaceKeycloakReadinessProbe Readiness { get; }
Source
Gets the readiness probe.
RealmImportFile
string RealmImportFile { get; }
Source
Gets the generated realm import file path.
Theme
AppSurfaceKeycloakThemeRegistration? Theme { get; }
Source
Gets secret-safe evidence for the optional local login theme.
AppSurfaceKeycloakRealmReadyRunner
SourceRuns the package-owned finite readiness verification process.
AppSurfaceKeycloakRealmReadyRunnerConfiguration
SourceReconstructs validated probe inputs from the explicit nonsecret executable environment contract.
AppSurfaceKeycloakDefaults
SourceDefault local-only values used by the AppSurface Keycloak AppHost proof package.
Remarks
These defaults intentionally mirror the AppSurface OIDC package callback paths without taking a runtime dependency on that package. Drift is covered by tests so the AppHost proof package does not become part of web auth registration.
Authority
string Authority(string realm = Realm, int port = KeycloakPort)
Source
Builds the default authority URL for a local realm and port.
Parameters
realmThe Keycloak realm name.portThe local Keycloak host port.
Returns
The local HTTPS authority URL.
SeededUserEmail
string SeededUserEmail(string username)
Source
Builds the default verified email address for a locally seeded Keycloak proof user.
Parameters
usernameThe seeded user's configured username.
Returns
The local-only email address for the user.
AppSurfaceKeycloakOptions
SourceConfigures the deterministic local Keycloak realm and public client used for AppSurface OIDC proof AppHosts.
Validate
void Validate()
Source
Validates all local Keycloak proof options and populates default redirect URIs when needed.
CreateConfigurationProjection
AppSurfaceKeycloakConfigurationProjection CreateConfigurationProjection()
Source
Builds the secret-safe configuration projection for the paired web proof.
Returns
An immutable projection containing only allowlisted OIDC configuration.
Realm
string Realm { get; set; }
Source
Gets or sets the local Keycloak realm name.
ClientId
string ClientId { get; set; }
Source
Gets or sets the local public OIDC client id.
ClientDisplayName
string ClientDisplayName { get; set; }
Source
Gets or sets the local display name imported for the OIDC client.
CallbackPath
string CallbackPath { get; set; }
Source
Gets or sets the OIDC callback path used by the web proof.
SignedOutCallbackPath
string SignedOutCallbackPath { get; set; }
Source
Gets or sets the OIDC signed-out callback path used by the web proof.
KeycloakPort
int KeycloakPort { get; set; }
Source
Gets or sets the fixed local Keycloak host port.
WebProofPort
int WebProofPort { get; set; }
Source
Gets or sets the fixed local web proof port used to build redirect URIs.
UsePersistentDataVolume
bool UsePersistentDataVolume { get; set; }
Source
Gets or sets a value indicating whether Keycloak data should persist in a container volume.
Remarks
Disposable data is the default so realm import is deterministic. Persistent data keeps admin credentials and imported realm state until the volume is deleted.
RealmImportDirectory
string RealmImportDirectory { get; set; }
Source
Gets or sets the directory that receives generated Keycloak realm import JSON.
LoginTheme
AppSurfaceKeycloakThemeOptions? LoginTheme { get; set; }
Source
Gets or sets the optional application-owned login theme used by the local Keycloak AppHost proof.
Remarks
When absent, Keycloak's existing behavior and the package's original five-minute proof remain unchanged. When present, the package validates and read-only mounts the theme only for local AppHost use; it does not publish an image or mutate a production realm.
RedirectUris
IList<Uri> RedirectUris { get; }
Source
Gets mutable redirect URIs imported into the public OIDC client.
PostLogoutRedirectUris
IList<Uri> PostLogoutRedirectUris { get; }
Source
Gets mutable post-logout redirect URIs imported into the public OIDC client.
SeededUsers
IList<AppSurfaceKeycloakUserOptions> SeededUsers { get; }
Source
Gets mutable local-only users imported into the proof realm.
AppSurfaceKeycloakThemeReleaseEvidence
SourceRepresents the secret-safe tuple that binds a packaged Keycloak login theme to the images and manifests it was verified against.
Create
AppSurfaceKeycloakThemeReleaseEvidence Create(AppSurfaceKeycloakThemeBuildContract buildContract, string finalImage)
Source
Creates release evidence from a verified build contract and the digest-pinned image that packages its theme.
Parameters
buildContractThe validated build contract that produced the image context.finalImageThe immutable image reference that contains the packaged theme.
Returns
A portable evidence tuple without source paths, realm imports, credentials, or property values.
Verify
void Verify(AppSurfaceKeycloakThemeBuildContract buildContract, string finalImage)
Source
Verifies that this evidence still represents the supplied build contract and final image reference.
Parameters
buildContractThe current validated build contract.finalImageThe expected digest-pinned final image reference.
Exceptions
AppSurfaceKeycloakExceptionThe evidence and supplied immutable inputs do not match.
Write
string Write(string outputFile)
Source
Atomically writes this release tuple to an application-owned evidence file.
Parameters
outputFileAn absent, application-owned JSON evidence file path.
Returns
The absolute evidence file path.
Exceptions
AppSurfaceKeycloakExceptionThe output path is invalid or cannot be safely materialized.
BeforeMoveForTesting
Action<string>? BeforeMoveForTesting { get; set; }
Source
Gets or sets a test-only action invoked after temporary evidence is written and immediately before its atomic move into place.
Remarks
The action is stored in AsyncLocal<Action<string>> so parallel test flows remain isolated. Tests must reset this property to null after use.
Schema
string Schema { get; }
Source
Gets the versioned evidence schema name.
ThemeName
string ThemeName { get; }
Source
Gets the registered Keycloak login theme name.
SourceManifestDigest
string SourceManifestDigest { get; }
Source
Gets the complete validated source-manifest digest.
PackagedManifestDigest
string PackagedManifestDigest { get; }
Source
Gets the immutable image-context manifest digest.
BuildContractDigest
string BuildContractDigest { get; }
Source
Gets the digest of the generated build contract.
KeycloakBaseImage
string KeycloakBaseImage { get; }
Source
Gets the digest-pinned Keycloak base-image reference.
FinalImage
string FinalImage { get; }
Source
Gets the digest-pinned image that contains the packaged theme.
Platform
string Platform { get; }
Source
Gets the verified container platform.
TemplateBaselineDigest
string? TemplateBaselineDigest { get; }
Source
Gets the optional reviewed FreeMarker baseline digest.
AppSurfaceKeycloakThemeRegistration
SourceExposes secret-safe evidence for a validated Keycloak login theme registration.
Parameters
NameThe validated Keycloak theme name.BaseImageThe canonical immutable Keycloak base-image reference.PlatformThe exact-image evidence platform.ManifestDigestThe deterministic source-manifest digest.TemplateBaselineDigestThe optional reviewed upstream template-baseline digest.
AppSurfaceKeycloakThemeRegistrationState
SourceHolds validated theme-registration state, including the resolved source directory and development-only paths that are excluded from immutable image evidence.
Parameters
SourceDirectoryThe resolved application-owned theme source directory.ManifestThe deterministic manifest of the complete validated source tree.BaseImageThe immutable Keycloak base image used for the local proof.TemplateBaselineDigestThe optional reviewed upstream template-baseline digest.DevelopmentOnlyResourcePathsSource-relative paths excluded from packaged image evidence.RegistrationThe secret-safe public registration evidence.
AppSurfaceKeycloakRealmReadyWorker
SourceResolves the framework-dependent executable payload for a package or project-reference AppHost.
AppSurfaceKeycloakRealmReadyWorkerInvocation
SourceHolds one resolved command invocation without exposing the local payload path as a public API.
AppSurfaceKeycloakRealmReadyConfiguration
SourceHolds the safe, immutable inputs needed to materialize the package-owned realm-ready executable.
AppSurfaceKeycloakRealmImportPaths
SourceResolves safe local paths for generated Keycloak realm import artifacts.
GetDefaultImportDirectory
string GetDefaultImportDirectory()
Source
Gets the default realm import directory without creating it.
Returns
The default directory beneath the application base directory.
ResolveImportDirectory
string ResolveImportDirectory(string rootDirectory, string resourceName)
Source
Resolves a resource-specific realm import directory without creating it.
Parameters
rootDirectoryRoot directory that owns generated realm imports.resourceNameResource name used as one safe path segment.
Returns
The resolved import directory.
GetRealmImportFilePath
string GetRealmImportFilePath(string realmImportDirectory, string realm)
Source
Resolves the generated realm import file beneath an import directory.
Parameters
realmImportDirectoryDirectory that contains realm imports.realmRealm id used in the generated file name.
Returns
The safe realm import file path.
AppSurfaceKeycloakThemeManifest
SourceRepresents deterministic, secret-safe evidence for a Keycloak login theme source tree.
Remarks
The manifest contains normalized relative paths, byte lengths, and content digests. It intentionally omits source machine paths and file contents so it can be retained as safe build evidence.
Create
AppSurfaceKeycloakThemeManifest Create(string themeName, string sourceDirectory)
Source
Creates a deterministic manifest for a resolved Keycloak theme source directory.
Parameters
themeNameValidated Keycloak theme name.sourceDirectoryAbsolute source directory containing the theme'slogindirectory.
Returns
A deterministic manifest with ordinally sorted entries.
AppSurfaceKeycloakThemeManifestEntry
SourceRepresents one normalized, content-addressed file in a Keycloak login theme manifest.
Parameters
RelativePathThe slash-separated path relative to the theme root.LengthThe exact file length in bytes.Sha256The lowercase hexadecimal SHA-256 digest of the file content.
AppSurfaceKeycloakPortPreflight
SourceProvides early local fixed-port diagnostics before Aspire starts containers or projects.
ThrowIfOccupied
void ThrowIfOccupied(int port, string optionName)
Source
Throws a safe diagnostic when a configured fixed port is already occupied.
Parameters
portThe local TCP port to check.optionNameThe option name that supplied the fixed port.
IsAvailable
bool IsAvailable(int port)
Source
Returns whether a local TCP port can be bound at preflight time.
Parameters
portThe local TCP port to check.
Returns
true when the port can be bound; otherwise false.
AppSurfaceKeycloakThemeOptions
SourceConfigures an application-owned Keycloak login theme for a local AppHost proof.
Remarks
This configuration affects only the AppHost resource. It does not build, publish, deploy, or administer a production Keycloak image or realm. The source directory must contain a Keycloak theme root with login/theme.properties.
Login
AppSurfaceKeycloakThemeOptions Login(string name, string sourceDirectory, AppSurfaceKeycloakImageReference baseImage)
Source
Creates an assets-only or inherited-template login-theme configuration.
Parameters
nameThe lower-case Keycloak login theme name.sourceDirectoryThe directory containing thelogintheme subtree.baseImageThe immutable Keycloak image whose theme behavior is being verified.
Returns
A configurable login-theme instance.
Validate
void Validate()
Source
Validates the theme source and declared resource/property requirements using the AppHost process base directory.
Name
string Name { get; set; }
Source
Gets or sets the lower-case Keycloak login theme name.
SourceDirectory
string SourceDirectory { get; set; }
Source
Gets or sets the directory containing the theme's login subtree.
Remarks
Relative paths are resolved once against the AppHost process base directory before validation and mounting. The resolved path is never exposed through the safe resource registration.
BaseImage
AppSurfaceKeycloakImageReference BaseImage { get; set; }
Source
Gets or sets the immutable Keycloak base image used by local theme proof.
Platform
string Platform { get; set; }
Source
Gets or sets the platform for exact-image evidence.
Remarks
Version one supports linux/amd64 exact runtime proof. Other platforms can use deterministic source validation, but must not claim the exact-image release proof.
TemplateBaselineDirectory
string? TemplateBaselineDirectory { get; set; }
Source
Gets or sets the directory holding the reviewed upstream FreeMarker baseline for copied template overrides.
Remarks
A source tree containing .ftl files must declare this directory. It contains only the expected slash-relative upstream template files and its digest is emitted as evidence beside the pinned image identity.
RequiredThemeProperties
IList<string> RequiredThemeProperties { get; }
Source
Gets property names that must occur in login/theme.properties without retaining their values in evidence.
RequiredResourcePaths
IList<string> RequiredResourcePaths { get; }
Source
Gets source-relative resources that must exist in the deterministic manifest.
DevelopmentOnlyResourcePaths
IList<string> DevelopmentOnlyResourcePaths { get; }
Source
Gets source-relative resources used only by the development bind mount.
Remarks
This declaration is validated but does not make an asset eligible for a future packaged-image proof.
AppSurfaceKeycloakLocalSeedContext
SourceSupplies a local seed factory with the safe Keycloak metadata and resource name it may bind to its own project.
Remarks
This context never carries Keycloak administrator credentials, client secrets, tokens, claims, external subjects, seeded-user passwords, provider responses, or consumer state. Bind a required consumer credential through AppSurfaceKeycloakLocalSeedOptions.WithRequiredSecretParameter instead.
ResourceName
string ResourceName { get; }
Source
Gets the exact required name for the consumer project resource.
Authority
string Authority { get; }
Source
Gets the safe local realm authority.
RealmName
string RealmName { get; }
Source
Gets the safe local realm name.
PublicClientId
string PublicClientId { get; }
Source
Gets the safe public OIDC client identifier.
AppSurfaceKeycloakThemeBuildContract
SourceCreates and verifies a deterministic, immutable-image-ready Keycloak login-theme build context.
Remarks
This contract materializes a validated source snapshot, a Containerfile, and secret-safe manifest metadata. The application or its CI system owns the actual image build, registry push, deployment, and production realm update.
Create
AppSurfaceKeycloakThemeBuildContract Create(AppSurfaceKeycloakThemeOptions theme)
Source
Creates a deterministic build contract from a configured login theme.
Parameters
themeThe application-owned login theme configuration.
Returns
A build contract that owns only the materialized local snapshot.
Write
string Write(string buildContextDirectory)
Source
Writes an immutable-image-ready snapshot to a new directory.
Parameters
buildContextDirectoryA currently absent output directory owned by the caller.
Returns
The absolute build context directory.
Exceptions
AppSurfaceKeycloakExceptionThe output would overwrite an existing context or fails verification.
VerifyPackagedTheme
void VerifyPackagedTheme(string packagedThemeDirectory)
Source
Verifies that a materialized or extracted image theme directory exactly matches this contract's manifest.
Parameters
packagedThemeDirectoryThe directory corresponding to/opt/keycloak/themes/{name}.
Exceptions
AppSurfaceKeycloakExceptionThe packaged content does not matchPackagedManifest.
CreateContainerfile
string CreateContainerfile()
Source
Creates the deterministic Containerfile content for the materialized snapshot.
Returns
The image build instructions without machine-local source paths.
Registration
AppSurfaceKeycloakThemeRegistration Registration { get; }
Source
Gets secret-safe evidence for the registered login theme.
Manifest
AppSurfaceKeycloakThemeManifest Manifest { get; }
Source
Gets the deterministic source manifest used by this build contract.
PackagedManifest
AppSurfaceKeycloakThemeManifest PackagedManifest { get; }
Source
Gets the deterministic manifest for the immutable image context after development-only resources are excluded.
Remarks
Manifest retains the complete validated local source manifest. Use this property to prove the packaged image content that Write(string) materializes and VerifyPackagedTheme(string) validates.
Digest
string Digest { get; }
Source
Gets the deterministic digest that binds the registration, source manifest, packaged manifest, and inputs used to derive the Containerfile.
AppSurfaceKeycloakUserOptions
SourceDescribes a deterministic local-only user imported into the AppSurface Keycloak proof realm.
Validate
void Validate()
Source
Validates the seeded user's username, subject, password, display name, and claim entries.
Exceptions
AppSurfaceKeycloakExceptionA seeded user option is invalid.
Username
string Username { get; }
Source
Gets the local Keycloak username.
Password
string Password { get; }
Source
Gets the temporary local-only password used by Keycloak realm import.
Remarks
This value is intentionally never included in runtime app configuration projection.
Subject
string Subject { get; }
Source
Gets the stable OIDC subject value.
DisplayName
string DisplayName { get; }
Source
Gets the local display name used by the proof UI.
Claims
IDictionary<string, string> Claims { get; }
Source
Gets local-only user attributes that should be imported and optionally mapped to claims.
AppSurfaceKeycloakDiagnosticCodes
SourceStable diagnostic codes emitted by the AppSurface Keycloak AppHost proof package.
AppSurfaceKeycloakRealmGenerator
SourceGenerates deterministic Keycloak realm import JSON for the AppSurface local proof.
Generate
string Generate(AppSurfaceKeycloakOptions options)
Source
Generates deterministic realm import JSON from validated options.
Parameters
optionsThe Keycloak proof options.
Returns
A JSON document suitable for Keycloak startup realm import.
WriteRealmImport
string WriteRealmImport(AppSurfaceKeycloakOptions options)
Source
Writes deterministic realm import JSON into the configured import directory.
Parameters
optionsThe Keycloak proof options.
Returns
The written realm import file path.
BeforeMoveForTesting
Action<string>? BeforeMoveForTesting { get; set; }
Source
Gets or sets a test-only action invoked after temporary realm evidence is written and immediately before its atomic replacement.
Remarks
The action is stored in AsyncLocal<Action<string>> so parallel test flows remain isolated. Tests must reset this property to null after use.
AppSurfaceKeycloakHostingExtensions
SourceAdds AppSurface local Keycloak proof resources to Aspire AppHosts.
AddAppSurfaceKeycloak
2 overloads
AppSurfaceKeycloakResource AddAppSurfaceKeycloak(this IDistributedApplicationBuilder builder, string name = AppSurfaceKeycloakDefaults.ResourceName, Action<AppSurfaceKeycloakOptions>? configure = null)
Source
Adds an official Aspire Keycloak resource configured with deterministic AppSurface local OIDC proof defaults.
Parameters
builderThe distributed application builder.nameThe Aspire resource name.configureOptional callback that customizes local proof options.
Returns
An AppSurface wrapper exposing the underlying Keycloak resource, secret-safe config projection, and readiness probe.
AppSurfaceKeycloakResource AddAppSurfaceKeycloak(this IDistributedApplicationBuilder builder, string name, IResourceBuilder<ParameterResource> adminUsername, IResourceBuilder<ParameterResource> adminPassword, Action<AppSurfaceKeycloakOptions>? configure = null)
Source
Adds an official Aspire Keycloak resource configured with deterministic AppSurface local OIDC proof defaults and explicit typed administrator parameters for finite consumer-owned local seed projects.
Parameters
builderThe distributed application builder.nameThe Aspire resource name.adminUsernameThe typed administrator username parameter supplied to the Keycloak container.adminPasswordThe typed secret administrator password parameter supplied to the Keycloak container.configureOptional callback that customizes local proof options.
Returns
An AppSurface wrapper exposing the underlying Keycloak resource, secret-safe config projection, and readiness probe.
Remarks
Use this overload only when a consumer-owned local seed must authenticate to the Keycloak Admin API. AppSurface does not read either parameter value. A seed receives the password only through AppSurfaceKeycloakLocalSeedOptions.WithRequiredSecretParameter and owns all administration work.
AppSurfaceKeycloakRealmReady
SourceRepresents the finite AppHost resource that proves an AppSurface local Keycloak realm is ready for dependent work.
Remarks
The package owns only this baseline proof. Provider administration, client creation, broker policy, credentials, mutations, retries, and convergence remain the responsibility of the consumer-owned finite project that waits for Resource to complete.
Resource
IResourceBuilder<ExecutableResource> Resource { get; }
Source
Gets the completion-bearing Aspire executable resource.
Remarks
Depend on this resource through Aspire's WaitForCompletion relationship. A dependent project starts only after the realm-ready process exits successfully.
AppSurfaceKeycloakReadinessProbe
SourcePerforms bounded, multi-signal readiness checks for the AppSurface local Keycloak proof.
CheckOnceAsync
Task<AppSurfaceKeycloakReadinessResult> CheckOnceAsync(CancellationToken cancellationToken = default)
Source
Checks metadata, generated realm evidence, and authorization challenge evidence once.
Parameters
cancellationTokenCancellation token for HTTP work.
Returns
A successful readiness result.
AppSurfaceKeycloakLocalSeedOptions
SourceConfigures the explicit local-only policy, predecessor, and typed secret bindings for one consumer seed project.
After
AppSurfaceKeycloakLocalSeedOptions After(AppSurfaceKeycloakLocalSeed predecessor)
Source
Requires this seed to follow the immediately preceding local seed returned by the same Keycloak wrapper.
Parameters
predecessorThe immediately prior returned seed handle.
Returns
This options instance for fluent configuration.
WithRequiredSecretParameter
AppSurfaceKeycloakLocalSeedOptions WithRequiredSecretParameter(string environmentVariableName, IResourceBuilder<ParameterResource> parameter)
Source
Binds one required Aspire secret parameter only to this seed's consumer project.
Parameters
environmentVariableNameThe consumer-owned environment variable name.parameterA typed Aspire parameter resource whoseParameterResource.Secretflag is true.
Returns
This options instance for fluent configuration.
Remarks
AppSurface validates parameter identity and secret metadata only; it never reads, logs, writes, serializes, or otherwise resolves the parameter value. The parameter may not be reused by a second seed in the same wrapper.
AllowedEnvironmentNames
IList<string> AllowedEnvironmentNames { get; }
Source
Gets local environment names in which seed registration is allowed, compared case-insensitively.
Remarks
The default is Development, Test, and Testing. Publish and every execution operation other than Aspire Run are always denied, even when this list contains a deployment-like environment.
AppSurfaceKeycloakLocalSeedSecretBinding
SourceStores a declared typed secret binding until the parent resource validates and applies it to the consumer project.
AppSurfaceKeycloakImageReference
SourceRepresents an immutable container image reference used to prove a Keycloak login theme.
Remarks
Theme verification is meaningful only when it is associated with a concrete Keycloak image. This type requires a registry, tag, and SHA-256 digest so a moving tag cannot silently change the template baseline beneath a theme.
Parse
AppSurfaceKeycloakImageReference Parse(string value)
Source
Parses a fully-qualified immutable container image reference.
Parameters
valueA reference inregistry/repository:tag@sha256:<64 lowercase hex characters>form.
Returns
The parsed image reference.
Exceptions
AppSurfaceKeycloakExceptionThe image reference is incomplete or non-deterministic.
Registry
string Registry { get; }
Source
Gets the container registry, including an optional port.
Image
string Image { get; }
Source
Gets the slash-separated repository name without the registry.
Tag
string Tag { get; }
Source
Gets the immutable-reference tag retained for human-readable evidence.
Sha256
string Sha256 { get; }
Source
Gets the lowercase hexadecimal SHA-256 image digest without the sha256: prefix.
Value
string Value { get; }
Source
Gets the canonical registry, image, tag, and digest reference.
AppSurfaceKeycloakLocalSeedPolicy
SourceValidates local seed registration before a consumer project can be launched.
AppSurfaceKeycloakException
SourceRepresents a safe AppSurface Keycloak proof diagnostic with a stable code.
Code
string Code { get; }
Source
Gets the stable AppSurface Keycloak diagnostic code.
AppSurfaceKeycloakRealmReadyEntryPoint
SourceHosts the package's finite realm-ready executable mode.