{
  "clients": [
    {
      "clientId": "petrolyst",
      "name": "Petrolyst",
      "description": "Petrolyst apps on the petrolyst server: Superset at atoma.petrolyst.com and the Traefik dashboard at traefik.petrolyst.com (oauth2-proxy). Managed from petrolyst-infra/keycloak/.",
      "enabled": true,
      "protocol": "openid-connect",
      "publicClient": false,
      "clientAuthenticatorType": "client-secret",
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": false,
      "frontchannelLogout": true,
      "baseUrl": "https://atoma.petrolyst.com/",
      "redirectUris": [
        "https://atoma.petrolyst.com/oauth-authorized/keycloak",
        "https://traefik.petrolyst.com/oauth2/callback"
      ],
      "webOrigins": ["+"],
      "attributes": {
        "pkce.code.challenge.method": "S256",
        "post.logout.redirect.uris": "https://atoma.petrolyst.com/*##https://traefik.petrolyst.com/*"
      },
      "protocolMappers": [
        {
          "name": "petrolyst client roles",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-usermodel-client-role-mapper",
          "consentRequired": false,
          "config": {
            "usermodel.clientRoleMapping.clientId": "petrolyst",
            "multivalued": "true",
            "claim.name": "petrolyst_roles",
            "jsonType.label": "String",
            "id.token.claim": "true",
            "access.token.claim": "true",
            "userinfo.token.claim": "true",
            "introspection.token.claim": "true"
          }
        }
      ]
    }
  ],
  "roles": {
    "client": {
      "petrolyst": [
        { "name": "superset-admin", "description": "Superset Admin at atoma.petrolyst.com" },
        { "name": "superset-editor", "description": "Superset Alpha: build charts and dashboards" },
        { "name": "superset-viewer", "description": "Superset Gamma: view dashboards shared with the role" },
        { "name": "atoma-reader", "description": "Superset ATOMA Reader: read the ATOMA dashboard only" },
        { "name": "traefik-admin", "description": "Traefik dashboard at traefik.petrolyst.com" }
      ]
    }
  }
}