Gemini Terraform code: Okta Keycloak integration

keycloak_oidc_identity_provider, okta_app_oauth

resource "okta_app_oauth" "keycloak_idp" {
 label       = "Keycloak Identity Broker"
 type        = "web"  # This tells Okta it's a standard web app (OIDC)
 status      = "ACTIVE"

 # The exact endpoint where Okta sends the login token back to Keycloak
 redirect_uris = [
   "https://keycloak.yourexample.com/realms/your-realm-name/broker/okta-oidc/endpoint"
 ]

 # Keycloak handles the Authorization Code flow natively
 grant_types   = ["authorization_code"]
 response_types = ["code"]

 token_endpoint_auth_method = "client_secret_post"
 consent_method             = "TRUSTED"

 # CRITICAL FOR BASIC LICENSE: This configures the Org Auth Server to 
 # include the user's groups inside the ID Token so Keycloak can read it.
 groups_claim {
   name        = "groups"
   type        = "FILTER"
   filter_type = "REGEX"
   value       = ".*"  # Matches and passes all groups the user belongs to
 }
}

Other properties

• post_logout_redirect_uris
• login_uri
• issuer_mode
• consent_method

Related

• Keycloak and Okta Integration: Complete Developer Guide
• default
• keycloak_oidc_identity_provider
• Terraform resource: okta_group
• identityProviders

See also

• /token, Decode token: iss, /userinfo, /authorize, token_endpoint_auth_method, token_type, Bearer, invalid_grant, invalid_client, /.well-known/openid-configuration, /oauth2/v1/token, Token metadata
• Terraform okta_app_oauth (ref), type, groups_claim, redirect_uris, grant_types, post_logout_redirect_uris, token_endpoint_auth_method