AppSurface Search
Section API Reference
API Reference Language: C# Component: Auth Audience: developer

Keycloak

Type

AppSurfaceKeycloakReadinessResult

Source

Captures safe readiness evidence for the AppSurface Keycloak local proof.

Parameters

  • Authority
    The verified Keycloak realm authority.
  • ClientId
    The verified public client id.
  • Realm
    The verified realm id.
Type

AppSurfaceKeycloakOptions

Source

Configures the deterministic local Keycloak realm and public client used for AppSurface OIDC proof AppHosts.

Method

Validate

void Validate()
Source

Validates all local Keycloak proof options and populates default redirect URIs when needed.

Method

CreateConfigurationProjection

AppSurfaceKeycloakConfigurationProjection CreateConfigurationProjection()
Source

Builds the secret-safe configuration projection for the paired web proof.

Returns

An immutable projection containing only allowlisted OIDC configuration.

Property

Realm

string Realm { get; set; } Source

Gets or sets the local Keycloak realm name.

Property

ClientId

string ClientId { get; set; } Source

Gets or sets the local public OIDC client id.

Property

ClientDisplayName

string ClientDisplayName { get; set; } Source

Gets or sets the local display name imported for the OIDC client.

Property

CallbackPath

string CallbackPath { get; set; } Source

Gets or sets the OIDC callback path used by the web proof.

Property

SignedOutCallbackPath

string SignedOutCallbackPath { get; set; } Source

Gets or sets the OIDC signed-out callback path used by the web proof.

Property

KeycloakPort

int KeycloakPort { get; set; } Source

Gets or sets the fixed local Keycloak host port.

Property

WebProofPort

int WebProofPort { get; set; } Source

Gets or sets the fixed local web proof port used to build redirect URIs.

Property

UsePersistentDataVolume

bool UsePersistentDataVolume { get; set; } Source

Gets or sets a value indicating whether Keycloak data should persist in a container volume.

Remarks

Disposable data is the default so realm import is deterministic. Persistent data keeps admin credentials and imported realm state until the volume is deleted.

Property

RealmImportDirectory

string RealmImportDirectory { get; set; } Source

Gets or sets the directory that receives generated Keycloak realm import JSON.

Property

LoginTheme

AppSurfaceKeycloakThemeOptions? LoginTheme { get; set; } Source

Gets or sets the optional application-owned login theme used by the local Keycloak AppHost proof.

Remarks

When absent, Keycloak's existing behavior and the package's original five-minute proof remain unchanged. When present, the package validates and read-only mounts the theme only for local AppHost use; it does not publish an image or mutate a production realm.

Property

RedirectUris

IList<Uri> RedirectUris { get; } Source

Gets mutable redirect URIs imported into the public OIDC client.

Property

PostLogoutRedirectUris

IList<Uri> PostLogoutRedirectUris { get; } Source

Gets mutable post-logout redirect URIs imported into the public OIDC client.

Property

SeededUsers

IList<AppSurfaceKeycloakUserOptions> SeededUsers { get; } Source

Gets mutable local-only users imported into the proof realm.

Type

AppSurfaceKeycloakException

Source

Represents a safe AppSurface Keycloak proof diagnostic with a stable code.

Property

Code

string Code { get; } Source

Gets the stable AppSurface Keycloak diagnostic code.

Type

AppSurfaceKeycloakLocalSeed

Source

Identifies one registered finite consumer project in an AppSurface local Keycloak seed chain.

Property

Name

string Name { get; } Source

Gets the caller-supplied stage name.

Property

Resource

IResourceBuilder<ProjectResource> Resource { get; } Source

Gets the consumer-owned finite project resource.

Remarks

Applications may make their own resources wait for this completion handle, but the normal next seed should be registered through AppSurfaceKeycloakResource.WithLocalSeed with AppSurfaceKeycloakLocalSeedOptions.After so the package can validate the linear chain.

Type

AppSurfaceKeycloakRealmGenerator

Source

Generates deterministic Keycloak realm import JSON for the AppSurface local proof.

Method

Generate

string Generate(AppSurfaceKeycloakOptions options)
Source

Generates deterministic realm import JSON from validated options.

Parameters

  • options
    The Keycloak proof options.

Returns

A JSON document suitable for Keycloak startup realm import.

Method

WriteRealmImport

string WriteRealmImport(AppSurfaceKeycloakOptions options)
Source

Writes deterministic realm import JSON into the configured import directory.

Parameters

  • options
    The Keycloak proof options.

Returns

The written realm import file path.

Property

BeforeMoveForTesting

Action<string>? BeforeMoveForTesting { get; set; } Source

Gets or sets a test-only action invoked after temporary realm evidence is written and immediately before its atomic replacement.

Remarks

The action is stored in AsyncLocal<Action<string>> so parallel test flows remain isolated. Tests must reset this property to null after use.

Type

AppSurfaceKeycloakThemeRegistration

Source

Exposes secret-safe evidence for a validated Keycloak login theme registration.

Parameters

  • Name
    The validated Keycloak theme name.
  • BaseImage
    The canonical immutable Keycloak base-image reference.
  • Platform
    The exact-image evidence platform.
  • ManifestDigest
    The deterministic source-manifest digest.
  • TemplateBaselineDigest
    The optional reviewed upstream template-baseline digest.
Type

AppSurfaceKeycloakThemeRegistrationState

Source

Holds validated theme-registration state, including the resolved source directory and development-only paths that are excluded from immutable image evidence.

Parameters

  • SourceDirectory
    The resolved application-owned theme source directory.
  • Manifest
    The deterministic manifest of the complete validated source tree.
  • BaseImage
    The immutable Keycloak base image used for the local proof.
  • TemplateBaselineDigest
    The optional reviewed upstream template-baseline digest.
  • DevelopmentOnlyResourcePaths
    Source-relative paths excluded from packaged image evidence.
  • Registration
    The secret-safe public registration evidence.
Type

AppSurfaceKeycloakRealmReady

Source

Represents the finite AppHost resource that proves an AppSurface local Keycloak realm is ready for dependent work.

Remarks

The package owns only this baseline proof. Provider administration, client creation, broker policy, credentials, mutations, retries, and convergence remain the responsibility of the consumer-owned finite project that waits for Resource to complete.

Property

Resource

IResourceBuilder<ExecutableResource> Resource { get; } Source

Gets the completion-bearing Aspire executable resource.

Remarks

Depend on this resource through Aspire's WaitForCompletion relationship. A dependent project starts only after the realm-ready process exits successfully.

Type

AppSurfaceKeycloakThemeBuildContract

Source

Creates and verifies a deterministic, immutable-image-ready Keycloak login-theme build context.

Remarks

This contract materializes a validated source snapshot, a Containerfile, and secret-safe manifest metadata. The application or its CI system owns the actual image build, registry push, deployment, and production realm update.

Method

Create

AppSurfaceKeycloakThemeBuildContract Create(AppSurfaceKeycloakThemeOptions theme)
Source

Creates a deterministic build contract from a configured login theme.

Parameters

  • theme
    The application-owned login theme configuration.

Returns

A build contract that owns only the materialized local snapshot.

Method

Write

string Write(string buildContextDirectory)
Source

Writes an immutable-image-ready snapshot to a new directory.

Parameters

  • buildContextDirectory
    A currently absent output directory owned by the caller.

Returns

The absolute build context directory.

Exceptions

  • AppSurfaceKeycloakException
    The output would overwrite an existing context or fails verification.
Method

VerifyPackagedTheme

void VerifyPackagedTheme(string packagedThemeDirectory)
Source

Verifies that a materialized or extracted image theme directory exactly matches this contract's manifest.

Parameters

  • packagedThemeDirectory
    The directory corresponding to /opt/keycloak/themes/{name} .

Exceptions

  • AppSurfaceKeycloakException
    The packaged content does not match PackagedManifest .
Method

CreateContainerfile

string CreateContainerfile()
Source

Creates the deterministic Containerfile content for the materialized snapshot.

Returns

The image build instructions without machine-local source paths.

Property

Registration

AppSurfaceKeycloakThemeRegistration Registration { get; } Source

Gets secret-safe evidence for the registered login theme.

Property

Manifest

AppSurfaceKeycloakThemeManifest Manifest { get; } Source

Gets the deterministic source manifest used by this build contract.

Property

PackagedManifest

AppSurfaceKeycloakThemeManifest PackagedManifest { get; } Source

Gets the deterministic manifest for the immutable image context after development-only resources are excluded.

Remarks

Manifest retains the complete validated local source manifest. Use this property to prove the packaged image content that Write(string) materializes and VerifyPackagedTheme(string) validates.

Property

Digest

string Digest { get; } Source

Gets the deterministic digest that binds the registration, source manifest, packaged manifest, and inputs used to derive the Containerfile.

Type

AppSurfaceKeycloakThemeOptions

Source

Configures an application-owned Keycloak login theme for a local AppHost proof.

Remarks

This configuration affects only the AppHost resource. It does not build, publish, deploy, or administer a production Keycloak image or realm. The source directory must contain a Keycloak theme root with login/theme.properties .

Method

Login

AppSurfaceKeycloakThemeOptions Login(string name, string sourceDirectory, AppSurfaceKeycloakImageReference baseImage)
Source

Creates an assets-only or inherited-template login-theme configuration.

Parameters

  • name
    The lower-case Keycloak login theme name.
  • sourceDirectory
    The directory containing the login theme subtree.
  • baseImage
    The immutable Keycloak image whose theme behavior is being verified.

Returns

A configurable login-theme instance.

Method

Validate

void Validate()
Source

Validates the theme source and declared resource/property requirements using the AppHost process base directory.

Property

Name

string Name { get; set; } Source

Gets or sets the lower-case Keycloak login theme name.

Property

SourceDirectory

string SourceDirectory { get; set; } Source

Gets or sets the directory containing the theme's login subtree.

Remarks

Relative paths are resolved once against the AppHost process base directory before validation and mounting. The resolved path is never exposed through the safe resource registration.

Property

BaseImage

AppSurfaceKeycloakImageReference BaseImage { get; set; } Source

Gets or sets the immutable Keycloak base image used by local theme proof.

Property

Platform

string Platform { get; set; } Source

Gets or sets the platform for exact-image evidence.

Remarks

Version one supports linux/amd64 exact runtime proof. Other platforms can use deterministic source validation, but must not claim the exact-image release proof.

Property

TemplateBaselineDirectory

string? TemplateBaselineDirectory { get; set; } Source

Gets or sets the directory holding the reviewed upstream FreeMarker baseline for copied template overrides.

Remarks

A source tree containing .ftl files must declare this directory. It contains only the expected slash-relative upstream template files and its digest is emitted as evidence beside the pinned image identity.

Property

RequiredThemeProperties

IList<string> RequiredThemeProperties { get; } Source

Gets property names that must occur in login/theme.properties without retaining their values in evidence.

Property

RequiredResourcePaths

IList<string> RequiredResourcePaths { get; } Source

Gets source-relative resources that must exist in the deterministic manifest.

Property

DevelopmentOnlyResourcePaths

IList<string> DevelopmentOnlyResourcePaths { get; } Source

Gets source-relative resources used only by the development bind mount.

Remarks

This declaration is validated but does not make an asset eligible for a future packaged-image proof.

Type

AppSurfaceKeycloakRealmReadyEnvironment

Source

Defines the nonsecret environment contract for the package-owned realm-ready executable.

Type

AppSurfaceKeycloakImageReference

Source

Represents an immutable container image reference used to prove a Keycloak login theme.

Remarks

Theme verification is meaningful only when it is associated with a concrete Keycloak image. This type requires a registry, tag, and SHA-256 digest so a moving tag cannot silently change the template baseline beneath a theme.

Method

Parse

AppSurfaceKeycloakImageReference Parse(string value)
Source

Parses a fully-qualified immutable container image reference.

Parameters

  • value
    A reference in registry/repository:tag@sha256:<64 lowercase hex characters> form.

Returns

The parsed image reference.

Exceptions

  • AppSurfaceKeycloakException
    The image reference is incomplete or non-deterministic.
Property

Registry

string Registry { get; } Source

Gets the container registry, including an optional port.

Property

Image

string Image { get; } Source

Gets the slash-separated repository name without the registry.

Property

Tag

string Tag { get; } Source

Gets the immutable-reference tag retained for human-readable evidence.

Property

Sha256

string Sha256 { get; } Source

Gets the lowercase hexadecimal SHA-256 image digest without the sha256: prefix.

Property

Value

string Value { get; } Source

Gets the canonical registry, image, tag, and digest reference.

Type

AppSurfaceKeycloakReadinessProbe

Source

Performs bounded, multi-signal readiness checks for the AppSurface local Keycloak proof.

Method

CheckOnceAsync

Task<AppSurfaceKeycloakReadinessResult> CheckOnceAsync(CancellationToken cancellationToken = default)
Source

Checks metadata, generated realm evidence, and authorization challenge evidence once.

Parameters

  • cancellationToken
    Cancellation token for HTTP work.

Returns

A successful readiness result.

Type

AppSurfaceKeycloakThemeReleaseEvidence

Source

Represents the secret-safe tuple that binds a packaged Keycloak login theme to the images and manifests it was verified against.

Method

Create

AppSurfaceKeycloakThemeReleaseEvidence Create(AppSurfaceKeycloakThemeBuildContract buildContract, string finalImage)
Source

Creates release evidence from a verified build contract and the digest-pinned image that packages its theme.

Parameters

  • buildContract
    The validated build contract that produced the image context.
  • finalImage
    The immutable image reference that contains the packaged theme.

Returns

A portable evidence tuple without source paths, realm imports, credentials, or property values.

Method

Verify

void Verify(AppSurfaceKeycloakThemeBuildContract buildContract, string finalImage)
Source

Verifies that this evidence still represents the supplied build contract and final image reference.

Parameters

  • buildContract
    The current validated build contract.
  • finalImage
    The expected digest-pinned final image reference.

Exceptions

  • AppSurfaceKeycloakException
    The evidence and supplied immutable inputs do not match.
Method

VerifyObservedImage

void VerifyObservedImage(ForgeTrust.AppSurface.Auth.Keycloak.VerifiedKeycloakImageEvidence observed)
Source

Requires actual observed image evidence for this theme release tuple.

Parameters

  • observed
    Evidence returned only by the shared exact-image inspector.

Exceptions

  • AppSurfaceKeycloakException
    The inspected image or platform differs from this release tuple.

Remarks

Requires image/platform binding, exact theme inventory, and an actual hash observation for every packaged member.

Method

Write

string Write(string outputFile)
Source

Atomically writes this release tuple to an application-owned evidence file.

Parameters

  • outputFile
    An absent, application-owned JSON evidence file path.

Returns

The absolute evidence file path.

Exceptions

  • AppSurfaceKeycloakException
    The output path is invalid or cannot be safely materialized.
Property

BeforeMoveForTesting

Action<string>? BeforeMoveForTesting { get; set; } Source

Gets or sets a test-only action invoked after temporary evidence is written and immediately before its atomic move into place.

Remarks

The action is stored in AsyncLocal<Action<string>> so parallel test flows remain isolated. Tests must reset this property to null after use.

Property

Schema

string Schema { get; } Source

Gets the versioned evidence schema name.

Property

ThemeName

string ThemeName { get; } Source

Gets the registered Keycloak login theme name.

Property

SourceManifestDigest

string SourceManifestDigest { get; } Source

Gets the complete validated source-manifest digest.

Property

PackagedManifestDigest

string PackagedManifestDigest { get; } Source

Gets the immutable image-context manifest digest.

Property

BuildContractDigest

string BuildContractDigest { get; } Source

Gets the digest of the generated build contract.

Property

KeycloakBaseImage

string KeycloakBaseImage { get; } Source

Gets the digest-pinned Keycloak base-image reference.

Property

FinalImage

string FinalImage { get; } Source

Gets the digest-pinned image that contains the packaged theme.

Property

Platform

string Platform { get; } Source

Gets the verified container platform.

Property

TemplateBaselineDigest

string? TemplateBaselineDigest { get; } Source

Gets the optional reviewed FreeMarker baseline digest.

Type

AppSurfaceKeycloakConfigurationProjection

Source

Secret-safe app configuration produced by the AppSurface Keycloak proof package.

Remarks

The projection only contains OIDC authority, client id, callback paths, and the public-client secret policy. It never contains admin credentials, seeded user passwords, realm JSON, tokens, raw claims, or client secrets.

Method

ApplyTo

IResourceBuilder<ProjectResource> ApplyTo(IResourceBuilder<ProjectResource> project)
Source

Applies the allowlisted environment variables to an Aspire project resource.

Parameters

  • project
    The project resource builder.

Returns

The same project resource builder for chaining.

Property

Authority

string Authority { get; } Source

Gets the local Keycloak realm authority.

Property

ClientId

string ClientId { get; } Source

Gets the local public client id.

Property

CallbackPath

string CallbackPath { get; } Source

Gets the OIDC callback path.

Property

SignedOutCallbackPath

string SignedOutCallbackPath { get; } Source

Gets the OIDC signed-out callback path.

Property

RequireClientSecret

bool RequireClientSecret { get; } Source

Gets a value indicating whether the paired proof app should require a client secret.

Property

EnvironmentVariables

IReadOnlyDictionary<string, string> EnvironmentVariables { get; } Source

Gets the allowlisted environment variables used by the proof web app.

Type

AppSurfaceKeycloakResource

Source

Wraps the official Aspire Keycloak resource with AppSurface local proof metadata.

Method

RealmReady

AppSurfaceKeycloakRealmReady RealmReady()
Source

Gets the lazily registered finite resource that proves the local Keycloak realm baseline is ready.

Returns

A cached completion-bearing resource that consumers can use as the first dependency for local seed projects.

Exceptions

  • AppSurfaceKeycloakException
    The wrapper was not created by AddAppSurfaceKeycloak(...) or the package-owned worker cannot be resolved.

Remarks

The returned resource waits for the official Keycloak resource to become healthy, then performs the package's bounded metadata, generated-realm, and public authorization-challenge checks in a separate finite process. It performs no Keycloak administration and receives no credentials. Calling this method repeatedly for the same wrapper returns the same resource and never adds a second gate to the AppHost graph.

Method

WithLocalSeed

AppSurfaceKeycloakLocalSeed WithLocalSeed(string name, Func<AppSurfaceKeycloakLocalSeedContext, IResourceBuilder<ProjectResource>> factory, Action<AppSurfaceKeycloakLocalSeedOptions>? configure = null)
Source

Registers one finite, consumer-owned project that seeds local Keycloak-adjacent state after baseline realm readiness.

Parameters

  • name
    A unique lower-case local seed stage name.
  • factory
    Creates exactly one finite Aspire ProjectResource using the supplied safe context.
  • configure
    Optional local-only ordering, environment-policy, and typed-secret configuration.

Returns

The registered local seed handle, including its consumer-owned project resource.

Exceptions

  • AppSurfaceKeycloakException
    Local policy, ordering, factory, or secret-binding validation fails.

Remarks

Registration is permitted only while the AppHost executes Run in Development , Test , or Testing by default. The first seed waits for RealmReady . Each later seed must nominate the immediately previous handle via AppSurfaceKeycloakLocalSeedOptions.After ; this intentionally creates one linear, observable completion chain. The package never starts a callback runner or performs Keycloak administration. The factory owns the actual client, mutation, retry, idempotence, and finite exit code.

Property

Resource

IResourceBuilder<KeycloakResource> Resource { get; } Source

Gets the underlying Aspire Keycloak resource builder for normal Aspire APIs such as WithReference and WaitFor .

Property

Configuration

AppSurfaceKeycloakConfigurationProjection Configuration { get; } Source

Gets the secret-safe web configuration projection.

Property

Readiness

AppSurfaceKeycloakReadinessProbe Readiness { get; } Source

Gets the readiness probe.

Property

RealmImportFile

string RealmImportFile { get; } Source

Gets the generated realm import file path.

Property

Theme

AppSurfaceKeycloakThemeRegistration? Theme { get; } Source

Gets secret-safe evidence for the optional local login theme.

Type

AppSurfaceKeycloakThemeManifest

Source

Represents deterministic, secret-safe evidence for a Keycloak login theme source tree.

Remarks

The manifest contains normalized relative paths, byte lengths, and content digests. It intentionally omits source machine paths and file contents so it can be retained as safe build evidence.

Method

Create

AppSurfaceKeycloakThemeManifest Create(string themeName, string sourceDirectory)
Source

Creates a deterministic manifest for a resolved Keycloak theme source directory.

Parameters

  • themeName
    Validated Keycloak theme name.
  • sourceDirectory
    Absolute source directory containing the theme's login directory.

Returns

A deterministic manifest with ordinally sorted entries.

Type

AppSurfaceKeycloakThemeManifestEntry

Source

Represents one normalized, content-addressed file in a Keycloak login theme manifest.

Parameters

  • RelativePath
    The slash-separated path relative to the theme root.
  • Length
    The exact file length in bytes.
  • Sha256
    The lowercase hexadecimal SHA-256 digest of the file content.
Type

AppSurfaceKeycloakLocalSeedPolicy

Source

Validates local seed registration before a consumer project can be launched.

Type

AppSurfaceKeycloakDefaults

Source

Default local-only values used by the AppSurface Keycloak AppHost proof package.

Remarks

These defaults intentionally mirror the AppSurface OIDC package callback paths without taking a runtime dependency on that package. Drift is covered by tests so the AppHost proof package does not become part of web auth registration.

Method

Authority

string Authority(string realm = Realm, int port = KeycloakPort)
Source

Builds the default authority URL for a local realm and port.

Parameters

  • realm
    The Keycloak realm name.
  • port
    The local Keycloak host port.

Returns

The local HTTPS authority URL.

Method

SeededUserEmail

string SeededUserEmail(string username)
Source

Builds the default verified email address for a locally seeded Keycloak proof user.

Parameters

  • username
    The seeded user's configured username.

Returns

The local-only email address for the user.

Type

AppSurfaceKeycloakRealmReadyWorker

Source

Resolves the framework-dependent executable payload for a package or project-reference AppHost.

Type

AppSurfaceKeycloakRealmReadyWorkerInvocation

Source

Holds one resolved command invocation without exposing the local payload path as a public API.

Type

AppSurfaceKeycloakRealmReadyConfiguration

Source

Holds the safe, immutable inputs needed to materialize the package-owned realm-ready executable.

Type

AppSurfaceKeycloakLocalSeedOptions

Source

Configures the explicit local-only policy, predecessor, and typed secret bindings for one consumer seed project.

Method

After

AppSurfaceKeycloakLocalSeedOptions After(AppSurfaceKeycloakLocalSeed predecessor)
Source

Requires this seed to follow the immediately preceding local seed returned by the same Keycloak wrapper.

Parameters

  • predecessor
    The immediately prior returned seed handle.

Returns

This options instance for fluent configuration.

Method

WithRequiredSecretParameter

AppSurfaceKeycloakLocalSeedOptions WithRequiredSecretParameter(string environmentVariableName, IResourceBuilder<ParameterResource> parameter)
Source

Binds one required Aspire secret parameter only to this seed's consumer project.

Parameters

  • environmentVariableName
    The consumer-owned environment variable name.
  • parameter
    A typed Aspire parameter resource whose ParameterResource.Secret flag is true.

Returns

This options instance for fluent configuration.

Remarks

AppSurface validates parameter identity and secret metadata only; it never reads, logs, writes, serializes, or otherwise resolves the parameter value. The parameter may not be reused by a second seed in the same wrapper.

Property

AllowedEnvironmentNames

IList<string> AllowedEnvironmentNames { get; } Source

Gets local environment names in which seed registration is allowed, compared case-insensitively.

Remarks

The default is Development , Test , and Testing . Publish and every execution operation other than Aspire Run are always denied, even when this list contains a deployment-like environment.

Type

AppSurfaceKeycloakLocalSeedSecretBinding

Source

Stores a declared typed secret binding until the parent resource validates and applies it to the consumer project.

Type

AppSurfaceKeycloakDiagnosticCodes

Source

Stable diagnostic codes emitted by the AppSurface Keycloak AppHost proof package.

Type

AppSurfaceKeycloakRealmImportPaths

Source

Resolves safe local paths for generated Keycloak realm import artifacts.

Method

GetDefaultImportDirectory

string GetDefaultImportDirectory()
Source

Gets the default realm import directory without creating it.

Returns

The default directory beneath the application base directory.

Method

ResolveImportDirectory

string ResolveImportDirectory(string rootDirectory, string resourceName)
Source

Resolves a resource-specific realm import directory without creating it.

Parameters

  • rootDirectory
    Root directory that owns generated realm imports.
  • resourceName
    Resource name used as one safe path segment.

Returns

The resolved import directory.

Method

GetRealmImportFilePath

string GetRealmImportFilePath(string realmImportDirectory, string realm)
Source

Resolves the generated realm import file beneath an import directory.

Parameters

  • realmImportDirectory
    Directory that contains realm imports.
  • realm
    Realm id used in the generated file name.

Returns

The safe realm import file path.

Type

AppSurfaceKeycloakHostingExtensions

Source

Adds AppSurface local Keycloak proof resources to Aspire AppHosts.

Method

AddAppSurfaceKeycloak

2 overloads
AppSurfaceKeycloakResource AddAppSurfaceKeycloak(this IDistributedApplicationBuilder builder, string name = AppSurfaceKeycloakDefaults.ResourceName, Action<AppSurfaceKeycloakOptions>? configure = null)
Source

Adds an official Aspire Keycloak resource configured with deterministic AppSurface local OIDC proof defaults.

Parameters

  • builder
    The distributed application builder.
  • name
    The Aspire resource name.
  • configure
    Optional callback that customizes local proof options.

Returns

An AppSurface wrapper exposing the underlying Keycloak resource, secret-safe config projection, and readiness probe.

AppSurfaceKeycloakResource AddAppSurfaceKeycloak(this IDistributedApplicationBuilder builder, string name, IResourceBuilder<ParameterResource> adminUsername, IResourceBuilder<ParameterResource> adminPassword, Action<AppSurfaceKeycloakOptions>? configure = null)
Source

Adds an official Aspire Keycloak resource configured with deterministic AppSurface local OIDC proof defaults and explicit typed administrator parameters for finite consumer-owned local seed projects.

Parameters

  • builder
    The distributed application builder.
  • name
    The Aspire resource name.
  • adminUsername
    The typed administrator username parameter supplied to the Keycloak container.
  • adminPassword
    The typed secret administrator password parameter supplied to the Keycloak container.
  • configure
    Optional callback that customizes local proof options.

Returns

An AppSurface wrapper exposing the underlying Keycloak resource, secret-safe config projection, and readiness probe.

Remarks

Use this overload only when a consumer-owned local seed must authenticate to the Keycloak Admin API. AppSurface does not read either parameter value. A seed receives the password only through AppSurfaceKeycloakLocalSeedOptions.WithRequiredSecretParameter and owns all administration work.

Type

AppSurfaceKeycloakRealmReadyRunner

Source

Runs the package-owned finite readiness verification process.

Type

AppSurfaceKeycloakRealmReadyRunnerConfiguration

Source

Reconstructs validated probe inputs from the explicit nonsecret executable environment contract.

Type

AppSurfaceKeycloakLocalSeedContext

Source

Supplies a local seed factory with the safe Keycloak metadata and resource name it may bind to its own project.

Remarks

This context never carries Keycloak administrator credentials, client secrets, tokens, claims, external subjects, seeded-user passwords, provider responses, or consumer state. Bind a required consumer credential through AppSurfaceKeycloakLocalSeedOptions.WithRequiredSecretParameter instead.

Property

ResourceName

string ResourceName { get; } Source

Gets the exact required name for the consumer project resource.

Property

Authority

string Authority { get; } Source

Gets the safe local realm authority.

Property

RealmName

string RealmName { get; } Source

Gets the safe local realm name.

Property

PublicClientId

string PublicClientId { get; } Source

Gets the safe public OIDC client identifier.

Type

AppSurfaceKeycloakUserOptions

Source

Describes a deterministic local-only user imported into the AppSurface Keycloak proof realm.

Method

Validate

void Validate()
Source

Validates the seeded user's username, subject, password, display name, and claim entries.

Exceptions

  • AppSurfaceKeycloakException
    A seeded user option is invalid.
Property

Username

string Username { get; } Source

Gets the local Keycloak username.

Property

Password

string Password { get; } Source

Gets the temporary local-only password used by Keycloak realm import.

Remarks

This value is intentionally never included in runtime app configuration projection.

Property

Subject

string Subject { get; } Source

Gets the stable OIDC subject value.

Property

DisplayName

string DisplayName { get; } Source

Gets the local display name used by the proof UI.

Property

Claims

IDictionary<string, string> Claims { get; } Source

Gets local-only user attributes that should be imported and optionally mapped to claims.

Type

AppSurfaceKeycloakPortPreflight

Source

Provides early local fixed-port diagnostics before Aspire starts containers or projects.

Method

ThrowIfOccupied

void ThrowIfOccupied(int port, string optionName)
Source

Throws a safe diagnostic when a configured fixed port is already occupied.

Parameters

  • port
    The local TCP port to check.
  • optionName
    The option name that supplied the fixed port.
Method

IsAvailable

bool IsAvailable(int port)
Source

Returns whether a local TCP port can be bound at preflight time.

Parameters

  • port
    The local TCP port to check.

Returns

true when the port can be bound; otherwise false .

Type

AppSurfaceKeycloakRealmReadyEntryPoint

Source

Hosts the package's finite realm-ready executable mode.