# IMPORTANT: This file contains the base translation. Modifying it directly is not recommended.
# To override or add custom messages, create a file named messages_en_override.properties in the same directory.
# This file will be automatically loaded and merged with the base translation.
# If you're implementing theme variants, you can also create variant-specific `.properties` files.
# For example let's say you have defined `themeName: ["vanilla", "chocolate"]` then you can create the following files:
# messages_en_override_vanilla.properties
# messages_en_override_chocolate.properties

cancel=Cancel
update=Update
deleteConfirm_other=Are you sure you want to delete these groups?
trusted-hosts.label=Trusted Hosts
registration-web-origins.label=Allowed Registration Web Origins
registration-web-origins.tooltip=Allows CORS requests from the specified web origins
deletedSuccess=Provider successfully deleted.
searchAttributes=Search attributes
userID=User ID
anyResource=Any resource
importAdded_zero=No records added.
createClientPolicy=Create client policy
clientSignature=Client signature required
persistent=Persistent
sync-ldap-roles-to-keycloak=Sync LDAP roles to Keycloak
eventTypes.PERMISSION_TOKEN.name=Permission token
permissionsDisable=Disable permissions?
eventTypes.FEDERATED_IDENTITY_LINK_ERROR.description=Federated identity link error
secretHasExpired=Secret has expired, please generate a new one by clicking the "Regenerate" button above
policyRolesHelp=Click on 'Add roles' to include accepted roles for this policy. Checking the 'required field' checkbox on a role indicates that the selected role MUST be present while evaluating policy, regardless of other roles. Leaving all relevant roles for the policy unchecked is the equivalent of setting a decision strategy of 'Affirmative'.
addLdapWizardTitle=Add LDAP user federation provider
wantAssertionsSignedHelp=Indicates whether this service provider expects a signed Assertion.
disableConfirm=Are you sure you want to disable '{{name}}'
eventTypes.CUSTOM_REQUIRED_ACTION.description=Custom required action
flowName=Flow name
userInfoResponseEncryptionContentEncryptionAlgorithm=User info response encryption content encryption algorithm
eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.name=Identity provider first login error
searchByRoleName=Search by role name
credentialType=Type
passLoginHint=Pass login_hint
openIdConnectCompatibilityModesHelp=This section is used to configure settings for backward compatibility with older OpenID Connect / OAuth 2 adaptors. It is useful especially if your client uses an older version of Keycloak / RH-SSO adapter.
emptyClientScopes=This client doesn't have any added client scopes
httpPostBindingAuthnRequestHelp=Indicates whether the AuthnRequest must be sent using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
policyEnforcementMode=Policy enforcement mode
eventTypes.CLIENT_UPDATE.name=Client update
addMultivaluedLabel=Add {{fieldLabel}}
notRepeat=Not repeat
secretRotated=Secret rotated
userFedDeleteConfirmTitle=Delete user federation provider?
userCredentialsHelpTextLabel=User Credentials Help Text
role=Role
displayName=Display name
applyToResourceTypeHelp=Specifies if this permission should be applied to all resources with a given type. In this case, this permission will be evaluated for all instances of a given resource type.
cibaIntervalHelp=The minimum amount of time in seconds that the CD (Consumption Device) must wait between polling requests to the token endpoint. If set to 0, the CD must use 5 as the default value according to the CIBA specification.
envelopeFrom=Envelope from
allowutf8=Allow UTF-8
eventTypes.UPDATE_TOTP.name=Update totp
updateCibaError=Could not update CIBA policy\: {{error}}
policyUrl=Policy URL
clientDescriptionHelp=Specifies description of the client. For example 'My Client for TimeSheets'. Supports keys for localized values as well. For example\: ${my_client_description}.
rolesPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
passwordPoliciesHelp.regexPattern=Requires that the password matches one or more defined Java regular expression patterns.
oAuthDPoP=Require DPoP bound tokens
invalidRealmName=Realm name can't contain special characters
validRedirectURIsHelp=Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed such as 'http\://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used. For SAML, you must set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
realmNameTitle={{name}} realm
subjectNameId=Subject NameID
credentialsList=Credentials List
usermodel.clientRoleMapping.clientId.label=Client ID
clientId=Client ID
serviceProviderEntityId=Service provider entity ID
internationalizationHelp=If enabled, you can choose which locales you support for this realm and which locale is the default.
managePriorityOrder=Manage priority order
contextualAttributesHelp=Any attribute provided by a running environment or execution context.
clientLoginTimeoutHelp=Max time a client has to finish the access token protocol. This should normally be 1 minute.
emptyMappers=No mappers
artifactBindingUrlHelp=URL to send the HTTP ARTIFACT messages to. You can leave this blank if you are using a different binding. This value should be set when forcing ARTIFACT binding together with IdP initiated login.
artifactBindingUrl=Artifact Binding URL
clientsList=Clients list
userId=User ID
eventTypes.CLIENT_UPDATE_ERROR.description=Client update error
eventTypes.UPDATE_EMAIL.description=Update email
eventTypes.VALIDATE_ACCESS_TOKEN.description=Validate access token
dedicatedScopeExplain=This is a client scope which includes the dedicated mappers and scope
updateOtpError=Could not update OTP policy\: {{error}}
addressClaim.postal_code.label=User Attribute Name for Postal Code
defaultRoles=Default roles
samlSignatureKeyNameHelp=Signed SAML documents contain identification of signing key in KeyName element. For Keycloak / RH-SSO counter-party, use KEY_ID, for MS AD FS use CERT_SUBJECT, for others check and use NONE if no other option works.
clientScopeTypes.default=Default
invalidateRotatedSecret=Invalidate rotated secret?
noDirectUsers=No direct users
whoCanEditHelp=If enabled, users or administrators can view and edit the attribute. Otherwise, users or administrators don't have access to write to the attribute.
eventTypes.LOGIN.name=Login
addressClaim.country.tooltip=Name of User Attribute, which will be used to map to 'country' subclaim inside 'address' token claim. Defaults to 'country'.
uuidLdapAttribute=UUID LDAP attribute
scopeNameHelp=Name of the client scope. Must be unique in the realm. Name should not contain space characters as it is used as value of scope parameter.
requiredUserActions=Required user actions
noConsentsText=The consents will only be recorded when users try to access a client that is configured to require consent. In that case, users will get a consent page which asks them to grant access to the client.
addStep=Add step
clientAssertionAudience=Client assertion audience
permissionPoliciesHelp=Specifies all the policies that must be applied to the permission.
userInitiatedActionLifespanHelp=Maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired. This value is recommended to be short because it is expected that the user would react to a self-created action quickly.
clearFileExplain=Are you sure you want to clear this file?
userModelAttribute=User model attribute
eventTypes.LOGOUT_ERROR.name=Logout error
allowRemoteResourceManagement=Remote resource management
syncRegistrationsHelp=Should newly created users be created within the LDAP store? Priority affects which provider is chosen to sync the new user. This setting is effectively applied only with WRITABLE edit mode.
resetPasswordAllowed=Forgot password
emptyExecution=No steps
passwordPolicyHintsEnabledHelp=Applicable just for writable MSAD. If on, then updating password of MSAD user will use LDAP_SERVER_POLICY_HINTS_OID extension, which means that advanced MSAD password policies like 'password history' or 'minimal password age' will be applied. This extension works just for MSAD 2008 R2 or newer.
expirationValueNotValid=Value should be greater than or equal to 1
eventTypes.UPDATE_CONSENT.name=Update consent
forceArtifactBinding=Force artifact binding
eventTypes.REFRESH_TOKEN_ERROR.description=Refresh token error
eventTypes.IMPERSONATE.name=Impersonate
updateFirstLogin=Update first login
columnDisplayDescription=Display description
flowUsedBy=Use of this flow
client-updater-trusted-hosts.label=Trusted hosts
updateExecutorSuccess=Executor updated successfully
ldapAttributeHelp=Name of mapped attribute on LDAP object. For example 'cn', 'sn', 'mail', 'street', etc.
assertionLifespan=Assertion Lifespan
export=Export
claimFilterNameHelp=Name of the essential claim
revocationDescription=This is a way to revoke all active sessions and access tokens. Not before means you can revoke any tokens issued before the date.
eventTypes.CODE_TO_TOKEN_ERROR.description=Code to token error
termsOfServiceUrl=Terms of service URL
requestObject.request_uri\ only=Request URI only
passwordPolicy=Password policy
backchannelLogout=Backchannel logout
addressClaim.street.label=User Attribute Name for Street
rolesScope=If there is no role scope mapping defined, each user is permitted to use this client scope. If there are role scope mappings defined, the user must be a member of at least one of the roles.
applyToResourceTypeFlag=Apply to resource type
offlineSessionIdleHelp=Time an offline session is allowed to be idle before it expires. You need to use offline token to refresh at least once within this period; otherwise offline session will expire.
eventTypes.UPDATE_TOTP.description=Update totp
testError=Error when trying to connect to LDAP\: '{{error}}'
groupObjectClassesHelp=Object class (or classes) of the group object. It is divided by commas if more classes are needed. In a typical LDAP deployment, it could be 'groupOfNames'. In Active Directory, it is usually 'group'.
filterByClients=Filter by clients
claims=Claims
createPolicyOfType=Create {{policyType}} policy
realmRolePrefix=Realm role prefix
flowUsedByDescription=This flow is used by the following {{value}}
createClientScope=Create client scope
includeRepresentation=Include representation
expireTimeHelp=Defines the time after which the policy MUST NOT be granted. Only granted if the current date/time is before or equal to this value.
singleLogoutServiceUrl=Single logout service URL
noRolesInstructions-roles=You haven't created any roles in this realm. Create a role to get started.
editIdPMapper=Edit Identity Provider Mapper
representation=Representation
remove=Remove
userProfile=User profile
unmanagedAttributes=Unmanaged Attributes
unmanagedAttributesHelpText=Unmanaged attributes are user attributes not explicitly defined in the user profile configuration. \
  By default, unmanaged attributes are `Disabled` and are not available from any context such as registration, account, and the administration console. \
  By setting `Enabled`, unmanaged attributes are fully recognized by the server and accessible through all contexts, useful if you are starting migrating an existing realm to the declarative user profile and you don't have yet all user attributes defined in the user profile configuration. \
  By setting `Only administrators can write`, unmanaged attributes can be managed only through the administration console and API, useful if you have already defined any custom attribute that can be managed by users but you are unsure about adding other attributes that should only be managed by administrators. \
  By setting `Only administrators can view`, unmanaged attributes are read-only and only available through the administration console and API.
unmanagedAttributePolicy.DISABLED=Disabled
unmanagedAttributePolicy.ENABLED=Enabled
unmanagedAttributePolicy.ADMIN_VIEW=Only administrators can view
unmanagedAttributePolicy.ADMIN_EDIT=Only administrators can write
confirmPasswordDoesNotMatch=Password and confirmation do not match.
eventTypes.DELETE_ACCOUNT_ERROR.description=Delete account error
provider=Provider
flows=Flows
passwordPoliciesHelp.length=The minimum number of characters required for the password.
root=Root
removeImportedUsersSuccess=Imported users have been removed.
eventTypes.VERIFY_PROFILE_ERROR.name=Verify profile error
signAssertionsHelp=Should assertions inside SAML documents be signed? This setting is not needed if document is already being signed.
authnContextClassRefsHelp=Ordered list of requested AuthnContext ClassRefs.
sessionsType.directGrant=Direct grant
validateSignature=Validate Signatures
useLowerCaseBearerType=Use lower-case bearer type in token responses
useRfc9068AccessTokenType=Use "at+jwt" as access token header type
headers=Headers
ldapAttributeNameHelp=Name of the LDAP attribute, which will be added to the new user during registration.
createAGroup=Create a group
effectiveProtocolMappersHelp=Contains all default client scopes and selected optional scopes. All protocol mappers and role scope mappings of all those client scopes will be used when generating access token issued for your client.
exportSuccess=Realm successfully exported.
scopePermissions.groups.manage-description=Policies that decide if an administrator can manage this group
testClusterFail=Failed verified availability for\: {{failedNodes}}. Fix or unregister failed cluster nodes and try again
eventExplain=Events are records of user and admin events in this realm. To configure the tracking of these events, go to <1>Event configs</1>.
queryExtensions=Query Supported Extensions
signingKeysConfig=Signing keys config
validateBindDn=You must enter the DN of the LDAP admin
addedGroupMembership=Added group membership
resourceDeletedSuccess=The resource successfully deleted
userObjectClasses=User object classes
useRefreshTokensHelp=If this is on, a refresh_token will be created and added to the token response. If this is off then no refresh_token will be generated.
getStarted=To get started, select a provider from the list below.
times.hours=Hours
signedJWTConfirm=Generate a private key and certificate for the client from the Keys tab.
permit=Permit
webOrigins=Web origins
searchAdminEventsBtn=Search admin events
deleteDialogDescription=Are you sure you want to permanently delete the attributes group <1>{{group}}</1>?
importResourceSuccess=The resource was successfully imported
inputTypeCols=Input cols
eventTypes.LOGOUT.description=Logout
deleteNodeBody=Are you sure you want to permanently delete the node "{{node}}"
lifespan=Expires In
storedTokensReadableHelp=Enable/disable if new users can read any stored tokens. This assigns the broker.read-token role.
authenticationFlowTypeHelp=What kind of form is it?
usersAdded_one={{count}} user added to the group
resourcesAndScopes=Resources and Scopes
editUsernameHelp=If enabled, the username field is editable, readonly otherwise.
eventTypes.UPDATE_CONSENT_ERROR.description=Update consent error
overrideActionTokensHelp=Override default settings of maximum time before an action permit sent by a user (such as a forgot password e-mail) is expired for a specific action. This value is recommended to be short because it is expected that the user would react to a self-created action quickly.
searchByName=Search by name
executorTypeSwitchHelpText=Executor Type Switch Help Text
attributeConsumingServiceNameHelp=Name of the Attribute Consuming Service profile to advertise in the SP metadata.
overrideActionTokens=Override Action Tokens
deleteGrantsError=Error deleting grants: {{error}}
defaultGroupAdded_other=Added {{count}} groups to the default groups
used.SPECIFIC_CLIENTS=Specific clients
freeMemory=Free memory
applyPolicy=Apply policy
userFedDeleteConfirm=If you delete this user federation provider, all associated data will be removed.
directGrantHelp=Select the flow you want to use for direct grant authentication.
unlockUsersSuccess=Any temporarily locked users are now unlocked
jsonType.tooltip=JSON type that should be used to populate the json claim in the token. long, int, boolean, String and JSON are valid values.
emptyPrimaryAction=Add predefined mapper
enableClientSignatureRequired=Enable "{{key}}"?
supportedApplicationsHelp=Applications that are known to work with the current OTP policy.
enableStartTLS=Enable StartTLS
syncModeOverride=Sync mode override
addAssociatedRolesError=Could not associate roles {{error}}
removeUserText=Do you want to remove {{numSelected}} users? These users will no longer have permissions of the role {{role}} and the associated roles of it.
diagramView=Diagram view
removeImportedUsers=Remove imported users?
accountLinkingOnly=Account linking only
clientPoliciesPoliciesHelpText=Client Policy allows binding client profiles with various conditions to specify when enforced behavior is specified by executors of the particular client profile.
editFlow=Edit flow
noDefaultGroupsInstructions=Default groups allow you to automatically assign group membership whenever any new user is created or imported throughout <1>identity brokering</1>. Add default groups to get started.
tokenSaveSuccess=New initial access token has been created
usermodel.attr.label=User Attribute
eventTypes.REGISTER.name=Register
eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.name=User disabled by permanent lockout
eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.name=User disabled by permanent lockout error
eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.name=User disabled by temporary lockout
eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.name=User disabled by temporary lockout error
deleteUser=Delete user
addedNodeSuccess=Node successfully added
eventTypes.INTROSPECT_TOKEN_ERROR.description=Introspect token error
webAuthnPolicyUserVerificationRequirementHelp=Communicates to an authenticator whether to require to verify a user.
syncModes.import=Import

showInAccountConsole=Show in Account console
showInAccountConsoleHelp=Defines how the identity provider will be available from the account console. If set to `Always`, it is always available. If set to `When linked`, it will be shown only when the user is linked to it. Otherwise, if set to `Never`, it will not be available even if the user is linked to it.
showInAccountConsole.always=Always
showInAccountConsole.when_linked=When linked
showInAccountConsole.never=Never

realmSaveError=Realm could not be updated\: {{error}}
authDataDescription=Represents a token carrying authorization data as a result of the processing of an authorization request. This representation is basically what Keycloak issues to clients asking for permission. Check the `authorization` claim for the permissions that where granted based on the current authorization request.
allowRemoteResourceManagementHelp=Should resources be managed remotely by the resource server? If false, resources can be managed only from this Admin UI.
generatedAccessTokenIsDisabled=Generated access token is disabled when no user is selected
addNewProvider=Add new provider
userInfoResponseEncryptionKeyManagementAlgorithm=User info response encryption key management algorithm
changedUsersSyncPeriod=Changed users sync period
keystoreHelp=Path to keys file
userRegistration=User registration
save=Save
helpFileUploadClient=Upload a JSON or XML file
generateSuccess=New key pair and certificate generated successfully
userAttributeValueHelp=Value you want to hardcode
whoCanViewHelp=If enabled, users or administrators can view the attribute. Otherwise, users or administrators don't have access to the attribute.
eventTypes.IDENTITY_PROVIDER_LOGIN.description=Identity provider login
includeClients=Include clients
copySuccess=Successfully copied to clipboard\!
eventTypes.LOGOUT_ERROR.description=Logout error
clientProfilesHelp=Client profiles applied on this policy.
deleteClientPolicyError=Could not delete policy\: {{error}}
selectAttribute=Select attribute
resourceAttributeHelp=The attributes associated with the resource.
updateCredentialUserLabelSuccess=The user label has been changed successfully.
product=Product
credentialUserLabel=User Label
passwordPoliciesHelp.passwordBlacklist=Prevents users to log in with a forbidden password that is listed in a file on the server.
bindTypeHelp=Type of the authentication method used during LDAP bind operation. It is used in most of the requests sent to the LDAP server. Currently only 'none' (anonymous LDAP authentication) or 'simple' (bind credential + bind password authentication) mechanisms are available.
whoWillAppearPopoverText=Groups are hierarchical. When you select Direct Membership, you see only the child group that the user joined. Ancestor groups are not included.
eventTypes.VERIFY_EMAIL.description=Verify email
eventTypes.REFRESH_TOKEN_ERROR.name=Refresh token error
partialImportHeaderText=Partial import allows you to import users, clients, and other resources from a previously exported JSON file.
disableSuccess=Provider successfully disabled
validatingPublicKeyIdHelp=Explicit ID of the validating public key given above if the key ID. Leave blank if the key above should be used always, regardless of key ID specified by external IDP; set it if the key should only be used for verifying if the key ID from external IDP matches.
eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.name=Identity provider link account error
subtree=Subtree
userFederation=User federation
effectiveRoleScopeMappingsHelp=Selected Optional Client Scopes, which will be used when issuing access token for this client. You can see above what value of OAuth Scope Parameter needs to be used when you want to have these optional client scopes applied when the initial OpenID Connect Authentication request will be sent from your client adapter.
disable=Disable
membershipLdapAttribute=Membership LDAP attribute
availableIdPs=Available identity providers
updateClientConditionSuccess=Condition updated successfully.
attributes=Attributes
roleDeleteConfirmDialog=This action will permanently delete the role "{{selectedRoleName}}". This cannot be undone.
clientDelete=Delete {{clientId}} ?
userDeletedSuccess=The user has been deleted
revokeClientScopesTitle=Revoke all granted client scopes?
contentSecurityPolicyReportOnlyHelp=For testing Content Security Policies <formattedlink>Learn more</formattedlink>
eventTypes.PERMISSION_TOKEN.description=Permission token
allow-default-scopes.label=Allow Default Scopes
minuteHelp=Defines the minute when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if the current minute is between or equal to the two values you provided.
updateCibaSuccess=CIBA policy successfully updated
newRoleNameHelp=The new role name. The new name format corresponds to where in the access token the role will be mapped to. So, a new name of 'myapp.newname' will map the role to that position in the access token. A new name of 'newname' will map the role to the realm roles in the token.
searchUserByAttributeMissingKeyError=Specify an attribute key
eventTypes.INVALID_SIGNATURE.name=Invalid signature
topLevelFlowTypeHelp=What kind of top level flow is it? Type 'client' is used for authentication of clients (applications) when generic is for users and everything else.
authDetailsHelp=Export and download all resource settings for this resource server.
policyProvider.regex=Define regex conditions for your permissions.
clientImportError=Could not import client\: {{error}}
members=Members
scopePermissions.clients.token-exchange-description=Policies that decide which clients are allowed exchange tokens for a token that is targeted to this client.
realmCertificateAliasHelp=Realm certificate is stored in archive too. This is the alias to it.
scopePermissions.roles.map-role-client-scope-description=Policies that decide if an administrator can apply this role to the client scope of a client
createIdentityProviderError=Could not create the identity provider\: {{error}}
eventTypes.SEND_VERIFY_EMAIL_ERROR.description=Send verify email error
deleteClientPolicyConfirm=This action will permanently delete the policy {{policyName}}. This cannot be undone.
cibaAuthRequestedUserHint=Authentication Requested User Hint
samlKeysExportError=Could not export keys due to\: {{error}}
webAuthnPolicyCreateTimeout=Timeout
comparison=Comparison
passwordPoliciesHelp.digits=The number of numerical digits required in the password string.
deletedSuccessClientScope=The client scope has been deleted
notAllowedToDeleteAllClientScopes=You are not allowed to delete all the client scopes.
columnDisplayName=Display name
noUsersFoundErrorStorage=No users found, could be due to wrongly configured federated provider {{error}}
lookAround=Look around window
storeTokensHelp=Enable/disable if tokens must be stored in the database after authenticating users. The token is then available for the Identity Brokering API.
storeTokenInSessionHelp=The token will be stored in the user session after authenticating the user. This is needed for internal to external Token Exchange V1 and can be used by Identity Brokering API V2 to retrieve the token from the current associated session.
revert=Revert
eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.description=Identity provider retrieve token
dependentPermission=Dependent permission
disableNonce=Disable nonce
disableTypeClaimCheck=Disable type claim check
addAssociatedRolesSuccess=Associated roles have been added
groupDeleted_one=Group deleted
userHelp=Optionally select user, for whom the example access token will be generated. If you do not select a user, example access token will not be generated during evaluation.
loginScreenCustomization=Login screen customization
policiesConfigType=Configure via\:
exportWarningTitle=Export with caution
emailVerifiedHelp=Has the user's email been verified?
emailPendingVerificationAlertTitle=Email pending verification
emailPendingVerificationResetAction=Click here to keep the current email.
emailPendingVerificationActionMessage=This action will remove the email pending verification for this user.
confirmEmailPendingVerificationAction=Keep current email
emailPendingVerificationUpdateError=Could not unset email pending verification.
userNotYetConfirmedNewEmail=The user has not confirmed the new email address {{email}}.
duplicateFlow=Duplicate flow
addExecution=Add execution
noSearchResultsInstructions=Click on the search bar above to search again
addedNodeFail=Could not add node\: '{{error}}'
groupMembership=Group membership
maxLength=Max length {{length}}
prompts.unspecified=Unspecified
revokeClientScopes=Are you sure you want to revoke all granted client scopes for {{clientId}}?
cibaBackhannelTokenDeliveryModes.poll=Poll
policies=Policies
parentClientScope=Parent client scope
reorder=Reorder
allTypes=All types
backchannelLogoutSessionRequired=Backchannel logout session required
ldapFilter=LDAP filter
eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.name=Pushed authorization request error
editAttribute=Edit attribute
webAuthnPolicyRpEntityNameHelp=Human-readable server name as WebAuthn Relying Party
postBrokerLoginFlowAlias=Post login flow
refreshTokenMaxReuse=Refresh Token Max Reuse
partialExportHeaderText=Partial export allows you to export realm configuration and other associated resources into a JSON file.
clientScopes=Client scopes
loadingRealms=Loading realms…
eventTypes.SEND_RESET_PASSWORD_ERROR.description=Send reset password error
httpPostBindingLogout=HTTP-POST binding logout
updateTranslationSuccess=Success\! Translation updated.
permissionDescription=A description for this permission.
policyClientHelp=Specifies which client(s) are allowed by this policy.
multivalued.label=Multivalued
buildIn=Built-in
roleCreateExplain=This is some description
scopePermissions.identityProviders.token-exchange-description=Policies that decide which clients are allowed exchange tokens for an external token minted by this identity provider.
algorithmNotSpecified=Algorithm not specified
jwtX509HeadersEnabled=Add X.509 Headers to the JWT
rememberMe=Remember me
flow.registration=Registration flow
flow.firstBrokerLogin=First broker login flow
showLess=Show less
registeredClusterNodes=Registered cluster nodes
connectionAndAuthenticationSettings=Connection and authentication settings
deleteConfirmUsers=Delete user?
storePassword=Store password
defaultGroups=Default groups
eventTypes.TOKEN_EXCHANGE_ERROR.name=Token exchange error
flow.browser=Browser flow
unlinkUsersSuccess=Unlink of users finished successfully.
addressClaim.street.tooltip=Name of User Attribute, which will be used to map to 'street_address' subclaim inside 'address' token claim. Defaults to 'street'.
webAuthnPolicyCreateTimeoutHint=Timeout needs to be between 0 seconds and 8 hours.
addValidator=Add validator
attributeImporter=Import declared SAML attribute if it exists in assertion into the specified user property or attribute.
userInfoSettings=User info settings
createAttributeError=Error\! User Profile configuration has not been saved {{error}}.
password=Password
eventTypes.VERIFY_EMAIL.name=Verify email
httpPostBindingResponseHelp=Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
artifactBindingResponseHelp=Indicates whether to respond to requests using ARTIFACT binding. If false, the HTTP-POST binding configuration will be evaluated.
eventTypes.IMPERSONATE.description=Impersonate
forbidden_other=Forbidden, permissions needed\:
clientAuthorization=Authorization
identityProvidersPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
removeMappingConfirm_other=Are you sure you want to remove {{count}} roles
kerberosWizardDescription=Text needed here.
welcome=Welcome to
events=Events
importHelp=Import a JSON file containing authorization settings for this resource server.
mapperType=Mapper type
importResources=The following settings and data will be imported\:
validateConnectionUrl=You must enter a connection URL
attributeConsumingServiceIndexHelp=Index of the Attribute Consuming Service profile to request during authentication.
clientSessionSettings=Client session settings
cibaAuthRequestedUserHintHelp=The way of identifying the end-user for whom authentication is being requested. Currently only "login_hint" is supported.
leaveGroupConfirmDialog_other=Are you sure you want to remove {{username}} from the {{count}} selected groups?
createTokenHelp=An initial access token can only be used to create clients.
removeImportedUsersError=Could not remove imported users\: '{{error}}'
eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.description=OAuth2 device code to token error
typeHelp=Client scopes, which will be added as default scopes to each created client.
linkedIdPs=Linked identity providers
htmlDisplayName=HTML Display name
groupObjectClasses=Group object classes
requiredActionPlaceholder=Select action
bindCredentials=Bind credentials
logoutSettings=Logout settings
validateServerPrincipal=You must enter a server principal
addMessageBundle=Add message bundle
realmName=Realm name
searchEventType=Search saved event type
idpInitiatedSsoRelayStateHelp=Relay state you want to send with SAML request when you want to do IDP Initiated SSO.
otpHashAlgorithmHelp=Hashing algorithm used to generate the OTP
joinGroup=Join Group
eventTypes.REMOVE_TOTP_ERROR.description=Remove totp error
eventTypes.EXECUTE_ACTION_TOKEN_ERROR.description=Execute action token error
unlinkAccountConfirm=Are you sure you want to permanently unlink this account from {{provider}}?
x509CertificateHelp=X509 Certificate encoded in PEM format
samlEndpointsLabel=SAML 2.0 Service Provider Metadata
passCurrentLocaleHelp=Pass the current locale to the identity provider as an ui_locales parameter.
lessThan=Must be less than {{value}}
webAuthnPolicyRequireResidentKeyHelp=Deprecated, use 'Discoverable credential' instead. It tells an authenticator whether to create a public key credential as a Discoverable Credential.
logoutServiceRedirectBindingURL=Logout Service Redirect Binding URL
createIdentityProviderSuccess=Identity provider successfully created
emptyMappersInstructions=If you want to add mappers, please click the button below to add some predefined mappers or to configure a new mapper.
dayMonth=Day
validatingX509Certs=Validating X509 certificates
eventTypes.CLIENT_UPDATE.description=Client update
searchInitialAccessToken=Search token
guiOrder=Display Order
friendlyName=Friendly name of attribute to search for in assertion. You can leave this blank and specify a name instead.
testSuccess=Successfully connected to LDAP
userInfoUrl=User Info URL
tokenIntrospectionUrl=Token Introspection URL
displayOnConsentScreen=Display on consent screen
alwaysDisplayConsent=Always display on consent screen
noClientPolicies=No client policies
defaultAdminInitiatedActionLifespanHelp=Maximum time before an action permit sent to a user by administrator is expired. This value is recommended to be long to allow administrators to send e-mails for users that are currently offline. The default timeout can be overridden immediately before issuing the token.
syncUsersSuccess=Sync of users finished successfully.
updatedCredentialMoveError=User Credential configuration hasn't been saved: {{error}}
searchForRoles=Search role by name
refresh=Refresh
roleDeletedSuccess=The role has been deleted
advancedClaimToRole=If all claims exist, grant the user the specified realm or client role.
directGrant=Direct Grant Flow
maxLifespanHelp=Max lifespan of cache entry in milliseconds
associatedRolesModalTitle=Add roles to {{name}}
nameIdFormatHelp=The name ID format to use for the subject.
detailsHelp=This is information about the details.
adminEvents=Admin events
serviceAccountHelp=Allows you to authenticate this client to Keycloak and retrieve access token dedicated to this client. In terms of OAuth2 specification, this enables support of 'Client Credentials Grant' for this client.
standardTokenExchangeEnabledHelp=Enable Standard Token Exchange V2 for this client.
jwtAuthorizationGrantEnabledHelp=Enable JSON Web Token (JWT) Profile for OAuth 2.0 Authorization Grant.
jwtAuthorizationGrantIdpHelp=Select Allowed Identity Providers that can be used to for JWT authorization grant validation
jwtAuthorizationGrantAudience=Custom audience mapping
jwtAuthorizationGrantAudienceHelp=Custom audience mapping for the JWT Authorization Grant. The key is the Identity Provider alias and the value is the custom audience enforced for this provider.
enableRefreshRequestedTokenTypeHelp=Controls if the Standard Token Exchange V2 allows to request a refresh token (parameter "requested_token_type" set to value "urn:ietf:params:oauth:token-type:refresh_token"). If this option is "No" (default), the refresh token request type is never allowed and an error is returned. If this option is "Same session", the returned refresh token is enforced to use the same session as the subject token, returning an error if that session is not available (for example if the subject token is transient).
sameSession=Same session
urisHelp=Set of URIs which are protected by resource.
eventTypes.IDENTITY_PROVIDER_RESPONSE.name=Identity provider response
confirmClientSecretTitle=Regenerate secret for this client?
serverPrincipal=Server principal
deleteConfirmGroup_one=Are you sure you want to delete this group '{{groupName}}'?
signDocuments=Sign documents
noTokens=No initial access tokens
addMapper=Add mapper
webauthnPolicy=WebAuthn Policy
userAttributeName=User attribute name to store SAML attribute. Use email, lastName, and firstName to map to those predefined user properties.
displayDescription=Display description
eventTypes.DELETE_ACCOUNT.description=Delete account
eventTypes.RESTART_AUTHENTICATION_ERROR.description=Restart authentication error
evictionHour=Eviction hour
onDragFinish=Dragging finished {{list}}
otpSupportedApplications.totpAppMicrosoftAuthenticatorName=Microsoft Authenticator
ldapMappersList=LDAP Mappers
bindDnHelp=DN of the LDAP admin, which will be used by Keycloak to access LDAP server
newClientProfileName=Client profile name
eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN_ERROR.name=OAuth2 device code to token error
eventTypes.TOKEN_EXCHANGE.description=Token exchange
continue=Continue
editProvider=Edit provider
included.client.audience.label=Included Client Audience
backchannelLogoutUrlHelp=URL that will cause the client to log itself out when a logout request is sent to this realm (via end_session_endpoint). The logout is done by sending logout token as specified in the OIDC Backchannel logout specification. If omitted, the logout request might be sent to the specified 'Admin URL' (if configured) in the format specific to Keycloak/RH-SSO adapters. If even 'Admin URL' is not configured, no logout request will be sent to the client.
updateScopeSuccess=Authorization scope successfully updated
userInfoResponseEncryptionKeyManagementAlgorithmHelp=JWA Algorithm used for key management in encrypting User Info Endpoint responses. This option is needed if you want encrypted User Info Endpoint responses. If left empty, User Info Endpoint responses are not encrypted.
authnContextDeclRefsHelp=Ordered list of requested AuthnContext DeclRefs.
inherent=Inherited
tableTitle=Attributes groups
generateNewKeys=Generate RSA keys
updateClientPolicySuccess=Client policy updated
unlock=Unlock
validateRealm=You must enter a realm
attributeValue=Attribute Value
eventTypes.CLIENT_DELETE_ERROR.description=Client delete error
revokeRefreshToken=Revoke Refresh Token
mappingUpdatedSuccess=Mapping successfully updated
logoUrlHelp=URL that references a logo for the Client application
operationTypes=Operation types
loginWithEmailAllowed=Login with email
expireTime=Expire time
requestObject.request\ or\ request_uri=Request or Request URI
policyProvider.user=Define conditions for your permissions where a set of one or more users is permitted to access an object.
protocolTypes.oid4vc=OpenID for Verifiable Credentials
protocolTypes.openid-connect=OpenID Connect
clientTypeHelp='OpenID Connect' allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server.'SAML' enables web-based authentication and authorization scenarios including cross-domain single sign-on (SSO) and uses security tokens containing assertions to pass information.
addOpenIdProvider=Add OpenID Connect provider
memory=Memory
cpu=CPU
processorCount=Processor Count
eventTypes.CLIENT_LOGIN.name=Client login
mapper.nameid.format.tooltip=This mapper is applied only if the NameID format of the incoming AuthnRequest is equal to this value.
hideOnLoginPageHelp=If hidden, login with this provider is possible only if requested explicitly, for example using the 'kc_idp_hint' parameter.
eventTypes.UPDATE_PROFILE.description=Update profile
assignRolesTo=Assign {{type}} roles to {{client}}
orderChangeError=Could not change display order of identity providers {{error}}
policyProvider.client-scope=Define conditions for your permissions where a set of one or more client scopes is permitted to access an object.
secretExpiresOn=Secret expires on {{time}}
searchClientByName=Search client by name
loginTimeout=Login timeout
attributeName=Attribute [Name]
updateError=Could not update the provider. {{error}}
importUsersHelp=If true, LDAP users will be imported into the local database and synced by the configured sync policies. If import is enabled, the username and email attributes will be stored in the local database using case-insensitivity values, in lower-case. If disabled, those attributes will be treated as case-sensitive and the values will have the same format from their corresponding LDAP entries.
emptyClientProfilesInstructions=There are no profiles, select 'Create client profile' to create a new client profile
policyProvider.js=Define conditions for your permissions using JavaScript. It is one of the rule-based policy types supported by Keycloak, and provides flexibility to write any policy based on the Evaluation API.
idpType.social=Social login
krbPrincipalAttribute=Kerberos principal attribute
fineGrainSamlEndpointConfig=Fine Grain SAML Endpoint Configuration
hours=Hours
eventTypes.RESET_PASSWORD_ERROR.name=Reset password error
yes=Yes
showRemaining=Show ${remaining}
searchProfile=Search profile
eventTypes.UPDATE_EMAIL_ERROR.name=Update email error
removeConfirm_other=Are you sure you want to remove these groups?
configure=Configure
searchScopeHelp=For one level, the search applies only for users in the DNs specified by User DNs. For subtree, the search applies to the whole subtree. See LDAP documentation for more details.
jumpToSection=Jump to section
noUsersEmptyStateDescription=Only the users with this role directly assigned will appear under this tab. If you need to find users assigned to this role, go to
manage=Manage
searchForSession=Search session
temporaryLockedHelp=The user may be locked due to multiple failed attempts to log in.
kerberosIntegration=Kerberos integration
useEntityDescriptorHelp=Import metadata from a remote IDP SAML entity descriptor.
decisionStrategies.CONSENSUS=Consensus
saveProviderSuccess=The provider has been saved successfully.
dedicatedScopes=Dedicated scopes
noSessionsDescription=There are currently no active sessions in this realm.
createGroupText=Create attributes group
otpPolicyCodeReusable=Reusable token
addRedirectUri=Add valid redirect URIs
time=Time
disableSigningExplain=If you disable "{{key}}", the Keycloak database will be updated and you may need to download a new adapter for this client.
used.DEFAULT=Default
authenticationCreateFlowHelp=Create flow.
credentialResetEmailSuccess=Email sent to user.
sslType.all=All requests
discoveryEndpointHelp=Import metadata from a remote IDP discovery descriptor.
excludeSessionStateFromAuthenticationResponse=Exclude Session State From Authentication Response
required=Required field
linkedIdPsText=The identity providers which are already linked to this user account
lastUpdated=Last updated
credentialResetBtn=Credential Reset
socialProfileJSONFieldPathHelp=Path of field in Social Provider User Profile JSON data to get value from. You can use dot notation for nesting and square brackets for array index. E.g. 'contact.address[0].country'.
userModelAttributeHelp=Name of the UserModel property or attribute you want to map the LDAP attribute into. For example 'firstName', 'lastName, 'email', 'street' etc.
userList=User list
eventTypes.RESET_PASSWORD.name=Reset password
exportWarningDescription=If your realm includes many groups, roles, or clients, the operation may make the server unresponsive for a while.
importRole=Import role
deleteClientProfileConfirm=This action will permanently delete the profile {{profileName}}. This cannot be undone.
signServiceProviderMetadataHelp=Enable/disable signature of the provider SAML metadata.
oAuthMutual=OAuth 2.0 Mutual TLS Certificate Bound Access Tokens Enabled
keystore=Keystore
eventTypes.EXECUTE_ACTION_TOKEN.description=Execute action token
eventTypes.CLIENT_INFO.description=Client info
updateClientProfilesError=Could not update client profiles\: {{error}}
canonicalizationHelp=Canonicalization Method for XML signatures.
authorizationHelp=Enable/Disable fine-grained authorization support for a client.
sessions=Sessions
mapperCreateSuccess=Mapper created successfully.
fullSyncPeriodHelp=Period for full synchronization in seconds
resourceTypeHelp=Specifies that this permission must be applied to all resource instances of a given type.
encryptionAlgorithmHelp=Encryption algorithm, which is used by the SAML IDP for encryption of SAML documents, assertions or IDs. The corresponding decryption key for decrypting SAML document parts is chosen based on this configured algorithm and should be available in realm keys for the encryption (ENC) usage. If no algorithm is configured, any supported algorithm is allowed and the decryption key is chosen based on the algorithm configured in the SAML document.
socialUserAttributeName=User attribute name to store information.
priority=Priority
jsonType.label=Claim JSON Type
fullScopeAllowed=Full scope allowed
syncModes.inherit=Inherit
masterSamlProcessingUrlHelp=If configured, this URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services. This can be individually overridden for each binding and service in the Fine Grain SAML Endpoint Configuration.
addedGroupMembershipError=Error adding group membership: {{error}}
authenticatorAttachment.platform=Platform
configSaveSuccess=Successfully saved the config
clientSecretAuthenticationAllowedMethod=Allowed authentication method
clientSecretAuthenticationAllowedMethodHelp=Allowed method for client secret authentication. If set to client_secret_basic, then client secret needs to be sent in the HTTP 'Authorization: Basic' header when authenticating this client. When set to client_secret_post, then client secret needs to be sent as a parameter in the request body together with client_id. When empty, both Authorization header and request body parameters are allowed.
regenerate=Regenerate
ignoreMissingGroups=Ignore missing groups
sslType.external=External requests
showMetaData=Show metadata
webAuthnPolicyAttestationConveyancePreferenceHelp=Communicates to an authenticator the preference of how to generate an attestation statement. None is used by specification if not specified.
acceptableAAGUIDsRequiresAttestation=Acceptable AAGUIDs require an attestation conveyance preference to be set and not None
top-level-flow-type.basic-flow=Basic flow
groupRemoveError=Error removing group {error}
temporaryPasswordHelpText=If enabled, the user must change the password on the next login
requestObjectEncryption=Request object encryption algorithm
exportAuthDetailsSuccess=Successfully exported authorization details.
connectionPooling=Connection pooling
wantAuthnRequestsSignedHelp=Indicates whether the identity provider expects a signed AuthnRequest.
policyCodeHelp=The JavaScript code providing the conditions for this policy.
eventTypes.IMPERSONATE_ERROR.description=Impersonate error
eventTypes.IDENTITY_PROVIDER_RESPONSE.description=Identity provider response
shouldBeANumber=Should be a number
validatorDialogColNames.colDescription=Description
requestObjectEncoding=Request object content encryption algorithm
idTokenEncryptionKeyManagementAlgorithmHelp=JWA Algorithm used for key management in encrypting ID tokens. This option is needed if you want encrypted ID tokens. If left empty, ID Tokens are just signed, but not encrypted.
idpInitiatedSsoUrlNameHelp=URL fragment name to reference client when you want to do IDP Initiated SSO. Leaving this empty will disable IDP Initiated SSO. The URL you will reference from your browser will be\: {server-root}/realms/{realm}/protocol/saml/clients/{client-url-name}.
keyPassword=Key password
attributeFriendlyName=Attribute [Friendly Name]
clearAllFilters=Clear all filters
scopePermissions.clients.map-roles-composite-description=Policies that decide if an administrator can apply roles defined by this client as a composite to another role
roleObjectClassesHelp=Object class (or classes) of the role object. It is divided by commas if more classes are needed. In a typical LDAP deployment, it could be 'groupOfNames'. In Active Directory, it is usually 'group'.
emptyAddClientScopes=No client scopes
changeTypeTo=Change type to
generateKeys=Generate keys?
searchForUser=Search user
groupRemove_one=Group removed
savePasswordError=Error saving password\: {{error}}
allGroups=All groups
deleteNode=Delete node?
rdnLdapAttributeHelp=Name of the LDAP attribute, which is used as the RDN (top attribute) of a typical user DN. It is typically the same attribute as the Username LDAP attribute; however, it is not required. For example, in Active directory, it is common to use 'cn' as the RDN attribute when the username attribute might be 'sAMAccountName'.
addAaguids=Add AAGUID
createPolicy=Create client policy
disablePolicyConfirm=Users and clients cannot access the policy if it is disabled. Are you sure you want to continue?
useDiscoveryEndpoint=Use discovery endpoint
clearAdminEvents=Clear admin events
eventTypes.CLIENT_DELETE.name=Client delete
clientLoginTimeout=Client Login Timeout
mapperSaveSuccess=Mapper saved successfully.
noRolesAssociatedInstructions=To add roles to this role, click 'Add role'.
alwaysDisplayInUIHelp=Always list this client in the Account UI, even if the user does not have an active session.
eventTypes.UPDATE_PASSWORD.name=Update password
eventTypes.UPDATE_CONSENT.description=Update consent
realmSaveSuccess=Realm successfully updated
executorTypeTextHelpText=Executor Type Text Help Text
eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.description=Identity provider login error
readTimeout=Read timeout
userInfoResponseEncryptionContentEncryptionAlgorithmHelp=JWA Algorithm used for content encryption in encrypting User Info Endpoint responses. If User Info response encryption key management algorithm is specified, the default for this value is A128CBC-HS256.
accessTokenSignatureAlgorithm=Access token signature algorithm
createUser=Create user
logoutAllDescription=If you sign out all active sessions, active subjects in this realm will be signed out.
credentialResetEmailError=Failed\: {{error}}
flow-type.form-flow=Form
useKerberosForPasswordAuthenticationHelp=Use Kerberos login module for authenticating username/password against Kerberos server instead of authenticating against LDAP server with Directory Service API.
guiOrderHelp=Specify order of the provider in GUI (such as in Consent page) as integer.
signDocumentsHelp=Should SAML documents be signed by the realm?
resetPassword=Reset password
requireSslHelp=Is HTTPS required? 'None' means HTTPS is not required for any client IP address. 'External requests' means localhost and private IP addresses can access without HTTPS. 'All requests' means HTTPS is required for all IP addresses.
policyDeletedSuccess=The Policy successfully deleted
manageServiceAccountUser=To manage detail and group mappings, click on the username <1>{{link}}</1>
addClientProfileSuccess=New client profile added
helpDisabled=Help off
deleteResource=Permanently delete resource?
validRequestURIsHelp=List of valid URIs that can be used as values of the 'request_uri' parameter during an OpenID Connect authentication request. No support exists for the same capabilities as for Valid Redirect URIs. For example, wildcards or relative paths.
emptyAddClientScopesInstructions=There are no client scopes left to add
changeTypeIntro={{count}} selected client scopes will be changed to
secretSizeHelp=Size in bytes for the generated secret
clientSecret=Client Secret
inputType=Input type
claimHelp=Name of claim to search for in token. You can reference nested claims by using a '.', for example, 'address.locality'. To use dot (.) literally, escape it with backslash (\\.).
regexClaimValues=Regex Claim Values
iconUri=Icon URI
allowed-protocol-mappers.label=Allowed Protocol Mappers
group=Group
addAssociatedRolesText=Add associated roles
enabledFeatures=Enabled features
groupsClaimHelp=If defined, the policy will fetch user's groups from the given claim within an access token or ID token representing the identity asking permissions. If not defined, user's groups are obtained from your realm configuration.
createGroup=Create group
validatingPublicKeyId=Validating public key id
clientAuthentications.client_secret_jwt=JWT signed with client secret
created=Created
updatedAt=Updated at
minutes=Minutes
displayOnClient=Display client on screen
certSubject=CERT_SUBJECT
userCredentialsHelpText=The top level handlers allow you to shift the priority of the credential for the user, the topmost credential having the highest priority. The handlers within one expandable panel allow you to change the visual order of the credentials, the topmost credential will show at the most left.
ldapAdvancedSettingsDescription=This section contains all the other options for more fine-grained configuration of the LDAP storage provider.
usersDN=Users DN
relativeUserCreateDn=Relative user creation DN
relativeUserCreateDnHelp=Relative DN from the 'Users DN' to where users will be created. For example, this allows users to be created in other DN than the parent 'Users DN' when using a subtree search scope.
secretSize=Secret size
included.custom.audience.label=Included Custom Audience
max-clients.label=Max Clients Per Realm
requestObjectSignatureAlgorithm=Request object signature algorithm
searchForGroups=Search group
noRolesAssociated=No associated roles
eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.name=Identity provider post login error
emptyStateMessage=No attributes groups
tokenLifespan.expires=Expires in
oidcAttributeImporter=Import declared claim if it exists in ID, access token, or the claim set returned by the user profile endpoint into the specified user property or attribute.
requestObject.request\ only=Request only
waitIncrementSeconds=Wait increment
requiredForLabel.admins=Only admins
clientScopeSuccess=Scope mapping updated
clientPolicySearch=Search client policy
refreshTokens=Refresh tokens
eventTypes.UPDATE_EMAIL_ERROR.description=Update email error
credentials=Credentials
webAuthnPolicyCreateTimeoutHelp=The timeout value for creating the user's public key credential in seconds. If set to 0, this timeout option is not adapted.
policyType.hotp=Counter based
claimFilterValue=Essential claim value
eventTypes.REGISTER_ERROR.name=Register error
priorityHelp=Priority of the provider
emptyPolicies=No policies
manageOrderTableAria=List of identity providers in the order listed on the login page
disableError=Could not disable the provider {{error}}
anyAlgorithm=Any algorithm
enableSSL=Enable SSL
general=General
failureFactor=Max login failures
maxSecondaryAuthFailures=Maximum Secondary Authentication Failures
updateClientPoliciesSuccess=The client policies configuration was updated
advancedSettings=Advanced settings
attributeValueHelp=Value the attribute must have. If the attribute is a list, then the value must be contained in the list.
eventTypes.FEDERATED_IDENTITY_LINK.description=Federated identity link
adminTheme=Admin theme
alias=Alias
eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.name=Send identity provider link error
eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.name=Federated identity link override
eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK.description=Federated identity link override
eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.name=Federated identity link override error
eventTypes.FEDERATED_IDENTITY_OVERRIDE_LINK_ERROR.description=Federated identity link override error
eventTypes.OAUTH2_EXTENSION_GRANT.name=OAuth2 extension grant
eventTypes.OAUTH2_EXTENSION_GRANT.description=OAuth2 extension grant
eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.name=OAuth2 extension grant error
eventTypes.OAUTH2_EXTENSION_GRANT_ERROR.description=OAuth2 extension grant error
userEvents=User events
inputTypePlaceholder=Input placeholder
otpPolicyPeriodErrorHint=Value needs to be between 1 second and 2 minutes.
introduction=If you want to leave this page and manage this realm, please click the corresponding menu items in the left navigation bar.
clearUserEvents=Clear user events
descriptionHelp=Help text for the description of the new flow
addCustomProvider=Add custom provider
permissionType=Specifies that this permission must be applied to all resources instances of a given type.
policyEnforcementModes.ENFORCING=Enforcing
rowSaveBtnAriaLabel=Save edits for {{messageBundle}}
permanentLockout=Permanent lockout
maxTemporaryLockouts=Maximum temporary lockouts
maxTemporaryLockoutsHelp=The number of temporary lockouts permitted before the user is permanently locked out.
bruteForceStrategy=Strategy to increase wait time
bruteForceStrategyHelp=Multiple means wait time will be increased only when number of failures are multiples of '{{failureFactor}}'. Linear means each new failure starting at '{{failureFactor}}' will increase wait time.
bruteForceStrategy.LINEAR=Linear
bruteForceStrategy.MULTIPLE=Multiple
debug=Debug
webAuthnPolicyRequireResidentKey=Require discoverable credential
webAuthnPolicyResidentKey=Discoverable credential
webAuthnPolicyResidentKeyHelp=Tells the authenticator to what extent a discoverable credential (resident key) is desired when registering. Replaces and takes precedence over the deprecated 'Require discoverable credential' option.
residentKeyRequirement.not\ specified=Not specified
residentKeyRequirement.required=Required
residentKeyRequirement.preferred=Preferred
residentKeyRequirement.discouraged=Discouraged
unlockUsersConfirm=All the users that are temporarily locked will be unlocked.
clear=Clear
idpType.custom=Custom
eventTypes.LOGOUT.name=Logout
deletedErrorClientScope=Could not delete client scope\: {{error}}
groupsClaim=Groups claim
roleMappingUpdatedError=Could not update role mapping {{error}}
client-updater-source-groups.label=Groups
frontchannelLogoutUrlHelp=URL that will cause the client to log itself out when a logout request is sent to this realm (via end_session_endpoint). If not provided, it defaults to the base url.
authenticationOverridesHelp=Override realm authentication flow bindings.
requiredActions=Required actions
requiredAction=Required action
requiredActionConfig=Configuration for {{name}}
selectLocales=Select locales
policyDecisionStagey=The decision strategy dictates how the policies associated with a given permission are evaluated and how a final decision is obtained. 'Affirmative' means that at least one policy must evaluate to a positive decision in order for the final decision to be also positive. 'Unanimous' means that all policies must evaluate to a positive decision in order for the final decision to be also positive. 'Consensus' means that the number of positive decisions must be greater than the number of negative decisions. If the number of positive and negative is the same, the final decision will be negative.
usermodel.prop.tooltip=Name of the property method in the UserModel interface. For example, a value of 'email' would reference the UserModel.getEmail() method.
kc.identity.authc.method=Authentication Method
regexAttributeValues=Regex Attribute Values
otpTypeHelp=totp is Time-Based One Time Password. 'hotp' is a counter base one time password in which the server keeps a counter to hash against.
setAsDefaultAction=Set as default action
clientPkceRequiredHelp=Require Proof Key for Code Exchange (PKCE) to protect against authorization code interception attacks. Public clients (client authentication disabled) should always require PKCE as they cannot securely store client secrets. It is also recommended for confidential clients as an additional layer of security. If not required, Keycloak only uses PKCE when the client includes a code challenge and method in its authorization request.
keyForCodeExchange=PKCE Method
clientProfiles=Client profiles
endpointsHelp=Shows the configuration of the Service Provider endpoint.
unlockAllUsers=Unlock all users
noGroupsText=You haven't added this user to any groups. Join a group to get started.
createClientPolicyError=Could not create policy due to\: {{error}}
eventTypes.EXECUTE_ACTIONS_ERROR.name=Execute actions error
path=Path
overwritten=Overwritten
mapperNameHelp=Name of the mapper
keyProviderMapperNameHelp=Display name of provider when linked in admin console.
providerIdHelp=Provider ID
deleteProviderError=Error deleting the provider: {{error}}
supportedLocalesHelp=The locales to support for this realm. The user chooses one of these locales on the login screen.
comparisonHelp=Specifies the comparison method used to evaluate the requested context classes or statements. The default is "Exact".
generatedIdTokenIsDisabled=Generated id token is disabled when no user is selected
nodeHost=Node host
eventTypes.REGISTER_NODE_ERROR.description=Register node error
eventListenersHelpTextHelp=Configure what listeners receive events for the realm.
acrToLoAMapping=ACR to LoA Mapping
advancedSettingsSaml=This section is used to configure advanced settings of this client
resetCredentialsError=Error resetting users credentials\: {{error}}
eventTypes.INTROSPECT_TOKEN.name=Introspect token
unspecified=Unspecified
deleteMappingTitle=Delete mapping?
profile=Profile
active=Active
generateKeysDescription=If you generate new keys, you can download the keystore with the private key automatically and save it on your client's side. Keycloak server will save just the certificate and public key, but not the private key.
importKeysDescription=Import a public key using different file formats. Please select the type of archive you want to import.
addSubFlowTitle=Add a sub-flow
useTruststoreSpiHelp=Specifies whether LDAP connection will use the Truststore SPI with the truststore configured in command-line options. 'Always' means that it will always use it. 'Never' means that it will not use it. Note that even if Keycloak truststore is not configured, the default java cacerts or certificate specified by 'javax.net.ssl.trustStore' property will be used.
forcePostBindingHelp=Always use POST binding for responses.
executorName=Name
VERIFY_EMAIL=Verify Email (VERIFY_EMAIL)
realmCertificateAlias=Realm certificate alias
roleName=Role name
addOrigins=Add Origin
evictionDayHelp=Day of the week the entry will become invalid.
actionTokens=Action tokens
permissionResources=Specifies that this permission must be applied to a specific resource instance.
testConnectionHint.withoutEmail=To test the connection you must first configure an e-mail address for the current user ({{userName}}).
includeOneTimeUseConditionHelp=Should a OneTimeUse Condition be included in login responses?
availableIdPsText=All the configured identity providers in this realm are listed here. You can link the user account to any of the IdP accounts.
accessTokenLifespanHelp=Max time before an access token is expired. This value is recommended to be short relative to the SSO timeout.
editableRowsTable=Editable rows table
redirectURIHelp=The redirect uri to use when configuring the identity provider.
permissionsEnabled=Permissions enabled
saveRealmError=Could not create realm {{error}}
attestationPreference.none=None
pairwiseSubAlgorithmSalt.label=Salt
addGroupsToGroupPolicy=Add groups to group policy
deniedScopes=Denied scopes
updateClientProfilesSuccess=The client profiles configuration was updated
flow.docker\ auth=Docker authentication flow
useEntityDescriptor=Use entity descriptor
loginActionTimeout=Login action timeout
windowsDomainQN=Windows Domain Qualified Name
deleteClientError=Could not delete profile\: {{error}}
validRedirectURIs=Valid URI pattern that a browser can redirect to after a successful login. Simple wildcards are allowed such as 'http\://example.com/*'. Also, you can use a relative path, such as /my/relative/path/*. Relative paths are relative to the client root URL; if that URL is not specified, the auth server root URL is used. For SAML, set valid URI patterns if you are relying on the consumer service URL embedded with the login request.
UPDATE_PROFILE=Update Profile (UPDATE_PROFILE)
assertionConsumerServicePostBindingURL=Assertion Consumer Service POST Binding URL
removeImported=Remove imported
endpoints=Endpoints
roleSaveError=Could not save role\: {{error}}
keySize=Key size
validity=Certificate expiration
validityHelp=Number of years the generated certificate is valid for.
membershipUserLdapAttributeHelp=Used only if the Membership Attribute Type is UID. It is the name of the LDAP attribute on the user, which is used for membership mappings. It is typically 'uid'. For example, if the value of 'Membership User LDAP Attribute' is 'uid' and the LDAP group has 'memberUid\: john', it is expected that particular LDAP user will have the attribute 'uid\: john'.
samlCapabilityConfig=SAML capabilities
accessTokenSignatureAlgorithmHelp=JWA algorithm used for signing access tokens.
derFormatted=DER formatted
periodicFullSyncHelp=If 'Import users' is enabled, a periodic task is started to synchronize users from LDAP to Keycloak. This type of synchronization fetches all users from LDAP on every run, importing new users or updating existing ones. If you have a large number of users in LDAP, this may be inefficient. In that case, you can disable this option and use 'Periodic changed users sync' instead.
periodicChangedUsersSyncHelp=If 'Import users' is enabled, a periodic task is started to synchronize users from LDAP to Keycloak based on their created or last updated timestamps. This type of synchronization is more efficient than a full sync, especially if you have a large number of users in LDAP. However, it requires that your LDAP server supports searching using the attributes 'createTimestamp' and 'modifyTimestamp' in query predicates.
signatureAlgorithmHelp=The signature algorithm to use to sign documents. Note that 'SHA1' based algorithms are deprecated and can be removed in the future. It is recommended to stick to some more secure algorithm instead of '*_SHA1'.
allow-default-scopes.tooltip=If on, newly registered clients will be allowed to have client scopes mentioned in realm default client scopes or realm optional client scopes
emailVerified=Email verified
addExecutionHelp=Execution can have a wide range of actions, from sending a reset email to validating an OTP.
requestObjectRequiredHelp=Specifies if the client needs to provide a request object with their authorization requests, and what method they can use for this. If set to "not required", providing a request object is optional. In all other cases, providing a request object is mandatory. If set to "request", the request object must be provided by value. If set to "request_uri", the request object must be provided by reference. If set to "request or request_uri", either method can be used.
clientScopesRolesScope=If there is no role scope mapping defined, each user is permitted to use this client scope. If there are role scope mappings defined, the user must be a member of at least one of the roles.
passwordPoliciesHelp.notUsername=The password cannot match the username.
passwordPoliciesHelp.notContainsUsername=The password cannot contain the username.
removeConfirm_one=Are you sure you want to remove this group?
createUserProviderSuccess=User federation provider successfully created
countHelp=Specifies how many clients can be created using the token.
Monday=Monday
resetCredentialsSuccess=The password has been reset successfully.
added=Added
authnContextDeclRefs=AuthnContext DeclRefs
clientAssertionAudienceHelp=The audience to use for the client assertion. The default value is the IDP's token endpoint URL.
externalRoleToRole=Looks for an external role in a keycloak access token. If external role exists, grant the user the specified realm or client role.
attributeGroup=Attribute group
deleteExecutionError=Could not delete execution\: {{error}}
hideInheritedRoles=Hide inherited roles
consentRequired=Consent required
selectMethodType.import=Import
standardFlow=Standard flow
votedToStatus=voted to {{status}}
credentialResetConfirmText=Are you sure you want to email this user?
clientScopeType.default=Default
helpFileUpload=Upload a JSON file
fileUploadPreviewDisabled=Preview disabled because content is too long.
addProvider_one=Add {{provider}} provider
clientPoliciesPolicies=Client Policies Policies
editUSernameHelp=If enabled, the username is editable, otherwise it is read-only.
flowCreatedSuccess=Flow created
fineGrainOpenIdConnectConfiguration=Fine grain OpenID Connect configuration
flow.reset\ credentials=Reset credentials flow
eventTypes.DELETE_ACCOUNT_ERROR.name=Delete account error
eventTypes.CLIENT_DELETE_ERROR.name=Client delete error
noRolesInstructions-client=You haven't created any roles for this client. Create a role to get started.
test=Test
leaveGroup_one=Leave group {{name}}?
count=Count
noPasswordPoliciesInstructions=You haven't added any password policies to this realm. Add a policy to get started.
testAuthentication=Test authentication
groupNameLdapAttributeHelp=Name of LDAP attribute that is used in group objects for the name and RDN of group. It is typically 'cn'. In this case, a typical group/role object may have DN such as 'cn\=Group1,ouu\=groups,dc\=example,dc\=org'.
deleteError=Could not delete the provider {{error}}
deleteErrorIdentityProvider=Could not delete identity provider mapper\: '{{error}}'
attributeDisplayName=Display name
pkceEnabled=Use PKCE
pkceRequired=Require PKCE
authorizationGrantSettings=Authorization Grant Settings
authorizationGrantSettingsHelp= This section is used to configure specific settings related to JWT Authorization Grant support as defined in RFC 7523. Not all settings are configured here, some belong to the identity provider, such as JWKS URL, Issuer and Allowed Clock Skew.
jwtAuthorizationGrantIdpEnabled=JWT Authorization Grant
jwtAuthorizationGrantIdpEnabledHelp=Enable the identity provider to act as a trust provider to validate authorization grant JWT assertions according to RFC 7523.
jwtAuthorizationGrantAssertionReuseAllowed=Allow assertion reuse
jwtAuthorizationGrantAssertionReuseAllowedHelp=If enabled, the jti claim is not required and assertions can be reused.
jwtAuthorizationGrantMaxAllowedAssertionExpiration=Max allowed assertion expiration
jwtAuthorizationGrantMaxAllowedAssertionExpirationHelp=Insert the max allowed expiration that the assertion can have.
jwtAuthorizationGrantAssertionSignatureAlg=Assertion signature algorithm
jwtAuthorizationGrantAssertionSignatureAlgHelp=Signature algorithm that should be used to sign the assertion, if not specified any signature algorithm will be valid.
jwtAuthorizationGrantLimitAccessTokenExp=Limit access token expiration
jwtAuthorizationGrantLimitAccessTokenExpHelp=If enabled the access token lifespan will be limited to the expiration of the JWT assertion but only if the JWT assertion expiration is less than the calculated access token expiration.
addJWTAuthorizationGrantProvider=Add JWT Authorization Grant Provider
jwtAuthorizationGrantJWKSUrl=JWKS URL
jwtAuthorizationGrantJWKSUrlHelp=URL where identity provider keys in JWK format are stored. See the JWK specification for more details
userProviderSaveSuccess=User federation provider successfully saved
month=Month
valueLabel=Value
dropNonexistingGroupsDuringSyncHelp=If this flag is true, then during sync of groups from LDAP to Keycloak, we will keep just those Keycloak groups that still exist in LDAP. The rest will be deleted.
expiration=Expiration
addKerberosWizardTitle=Add Kerberos user federation provider
noPasswordPolicies=No password policies
resourceTypes=Resource types
deleteConfirmTitle_one=Delete group
eventTypes.UPDATE_PROFILE_ERROR.description=Update profile error
webAuthnUpdateSuccess=Updated WebAuthn policies successfully
authorizationSignedResponseAlg=Authorization response signature algorithm
includeInUserInfo.label=Add to userinfo
onDragMove=Dragging item {{item}}
back=Back
deleteScopeConfirm=If you delete this authorization scope, some permissions will be affected.
updateOtpSuccess=OTP policy successfully updated
title=Authentication
deleteAttributeError=Attribute not deleted: {{error}}
enableClientSignatureRequiredExplain=If you enable "{{key}}", the adapter of this client will be updated. You may need to download a new adapter for this client. You need to generate or import keys for this client otherwise the authentication will not work.
policiesConfigTypes.formView=Form view
residentKey.No=No
nodeReRegistrationTimeout=Node Re-registration timeout
fineGrainSamlEndpointConfigHelp=This section to configure exact URLs for Assertion Consumer and Single Logout Service.
connectionURL=Connection URL
validateCustomUserSearchFilter=Filter must be enclosed in parentheses, for example\: (filter)
accessTokenLifespan=Access Token Lifespan
loginWithEmailHelpText=Allow users to log in with their email address.
eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.name=Identity provider link account
deleteMessageBundleSuccess=Successfully removed the message from the bundle
retry=Press here to refresh and continue
selectAttributes=Select attributes
firstBrokerLoginFlowAliasOverrideHelp=Alias of authentication flow, which is triggered after the first login with this identity provider. The term 'First Login' means that no Keycloak account is currently linked to the authenticated identity provider account.
owner=Owner
eventTypes.VERIFY_PROFILE.description=Verify profile
executorAuthenticatorMultiSelectHelpText=Executor Authenticator MultiSelect Help Text
eventTypes.FEDERATED_IDENTITY_LINK_ERROR.name=Federated identity link error
eventTypes.EXECUTE_ACTIONS.name=Execute actions
encryptAssertions=Encrypt assertions
disableConfirmTitle=Disable realm?
disableConfirmClientTitle=Disable client?
disableConfirmClient=Are you sure you want to disable this client?
custom=Custom Attribute...
keyTab=Key tab
addSamlProvider=Add SAML provider
addSpiffeProvider=Add SPIFFE provider
addKubernetesProvider=Add Kubernetes provider
spiffeTrustDomain=SPIFFE Trust Domain
spiffeTrustDomainHelp=Use a URL starting with 'spiffe://' followed by a domain name. For example, 'spiffe://acme.com'.
spiffeBundleEndpoint=SPIFFE Bundle or OIDC JWKs endpoint
kubernetesIssuerUrlHelp=The issuer of the Kubernetes service account tokens
kubernetesIssuerUrl=Kubernetes Issuer URL
permission=Permission
saveEventListeners=Save Event Listeners
capabilityConfig=Capability config
home=Home
bindFlow=Bind flow
userAttributeValue=User Attribute Value
browserFlowHelp=Select the flow you want to use for browser authentication.
tokenLifespan.never=Never expires
notFound=Could not find the resource that you are looking for
passMaxAge=Pass max_age
disablePolicyConfirmTitle=Disable policy?
eventTypes.LOGIN_ERROR.description=Login error
linkAccount=Link account
attestationPreference.direct=Direct
eventTypes.OAUTH2_DEVICE_AUTH_ERROR.description=OAuth2 device authentication error
unlinkUsers=Unlink users
userLdapFilter=User LDAP filter
emailVerification=Email Verification
configSaveError=Could not save the config\: {{error}}
clientAuthenticatorTypeHelp=Client Authenticator used for authentication of this client against Keycloak server
cachePolicyHelp=Cache Policy for this storage provider. 'DEFAULT' is whatever the default settings are for the global cache. 'EVICT_DAILY' is a time of day every day that the cache will be invalidated. 'EVICT_WEEKLY' is a day of the week and time the cache will be invalidated. 'MAX_LIFESPAN' is the time in milliseconds that will be the lifespan of a cache entry.
eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.description=Custom required action error
eventTypes.SEND_RESET_PASSWORD.name=Send reset password
requiredFor=Required for
scopePermissions.users.map-roles-description=Policies that decide if administrator can map roles for all users
bindCredentialsHelp=Password of LDAP admin. This field is able to obtain its value from vault, use ${vault.ID} format.
searchForAdminEvent=Search admin event
unitLabel=Select a time unit
webAuthnPolicySignatureAlgorithms=Signature algorithms
eventTypes.GRANT_CONSENT_ERROR.name=Grant consent error
action=Action
shortVerificationUri=Short verification_uri in Device Authorization flow
placeholderText=Select one
deleteCredentialsError=Error deleting users credentials\: {{error}}
authDefaultActionTooltip=If enabled, any new user will have this required action assigned to it.
validateBindCredentials=You must enter the password of the LDAP admin
evictionMinuteHelp=Minute of the hour the entry will become invalid
includeAuthnStatement=Include AuthnStatement
validatorType=Validator type
attributesHelp=Name and (regex) value of the attributes to search for in token. The configured name of an attribute is searched in SAML attribute name and attribute friendly name fields. Every given attribute description must be met to set the role. If the attribute is an array, then the value must be contained in the array. If an attribute can be found several times, then one match is sufficient.
samlAttributeToRole=If an attribute exists, grant the user the specified realm or client role.
enableStartTls=Enable StartTLS
addIdPMapper=Add Identity Provider Mapper
createPermissionSuccess=Successfully created the permission
roleAuthentication=Role authentication
homeURL=Home URL
eventTypes.REVOKE_GRANT_ERROR.name=Revoke grant error
contentSecurityPolicyReportOnly=Content-Security-Policy-Report-Only
firstBrokerLoginFlowAlias=First login flow
firstBrokerLoginFlowAliasOverride=First login flow override
missingAttributes=No {{label}} have been defined yet. Click the below button to add {{label}}, key and value are required for a key pair.
testConnectionError=Error\! {{error}}
authenticatedAccessPoliciesHelp=Those Policies are used when Client Registration Service is invoked by authenticated request. This means that the request contains Initial Access Token or Bearer Token.
deleteClientPolicyProfileSuccess=Profile successfully removed from the policy.
reGenerateSigningExplain=If you regenerate the signing key for client, the Keycloak database will be updated, and you may need to download a new adapter for this client.
reGenerateEncryptionExplain=If you regenerate the encryption key for client, the Keycloak database will be updated, and you may need to download a new adapter for this client.
evaluate=Evaluate
enableLdapv3Password=Enable the LDAPv3 password modify extended operation
status=Status
dragInstruction=Click and drag to change priority
clients=Clients
clientName=Name
syncModes.force=Force
deleteMappingConfirm=Are you sure you want to delete this mapping?
createClientProfileSuccess=New client profile created
eventTypes.CLIENT_LOGIN_ERROR.description=Client login error
explainBearerOnly=This is a special OIDC type. This client only allows bearer token requests and cannot participate in browser logins.
noTranslationsInstructions=Add a translation to get started.
clearFile=Clear this file
allowCreate=Allow create
providerUpdatedError=Could not update client policy due to {{error}}
usersAddedError=Could not add users to the group\: {{error}}
orderChangeErrorUserFed=Could not change the priority order of user federation providers {{error}}
scopeParameterPlaceholder=Select scope parameters
deleteClientPolicyConfirmTitle=Delete policy?
validateRdnLdapAttribute=You must enter an RDN LDAP attribute
policyUrlHelp=URL that the Relying Party Client provides to the End-User to read about the how the profile data will be used
fromDisplayName=From display name
affirmative=Affirmative
clientRoles=Client roles
removeRoles=Remove roles
flowNameDescriptionHelp=Help text for the name description of the new flow
maxFailureWaitSecondsHelp=Max time a user will be locked out.
groupsPath=Groups path
useRealmRolesMapping=Use realm roles mapping
identityProviderEntityId=Identity provider entity ID
userInfoSignedResponseAlgorithm=User info signed response algorithm
selectGroup=Select group
selectOrgGroup=Select Organization Group
groupType=Group type
groupTypeHelp=Indicates whether the selected group is a realm group or an organization group. This determines where the mapper will look for the group when it is executed.
scopePermissions.groups.view-members-description=Policies that decide if an administrator can view the members of this group
tableOfGroups=Table of groups
allowed-protocol-mappers.tooltip=List of allowed protocol mapper providers. If there is an attempt to register client, which contains some protocol mappers, which were not allowed, registration request will be rejected.
policyProvider.role=Define conditions for your permissions where a set of one or more roles is permitted to access an object.
targetOptions.brokerId=BROKER_ID
eventTypes.VERIFY_PROFILE.name=Verify profile
useRealmRolesMappingHelp=If true, then LDAP role mappings will be mapped to realm role mappings in Keycloak. Otherwise it will be mapped to client role mappings.
forwardParameters=Forwarded query parameters
isAccessTokenJWTHelp=The Access Token received from the Identity Provider is a JWT and its claims will be accessible for mappers.
frontchannelLogoutUrl=Front-channel logout URL
frontchannelLogoutSessionRequired=Front-channel logout session required
frontchannelLogoutSessionRequiredHelp=Specifying whether a sid (session ID) and iss (issuer) parameters are included in the Logout request when the Front-channel Logout URL is used.
testConnectionHint.withoutEmailAction=Configure e-mail address
webAuthnUpdateError=Could not update WebAuthn policies due to {{error}}
paginationHelp=Whether the LDAP server supports pagination
oAuthMutualHelp=This enables support for OAuth 2.0 Mutual TLS Certificate Bound Access Tokens, which means that Keycloak binds an access token and a refresh token with an X.509 certificate of a token requesting client exchanged in mutual TLS between keycloak's Token Endpoint and this client. These tokens can be treated as Holder-of-Key tokens instead of bearer tokens.
deleteProviderTitle=Delete key provider?
scopes=Scopes
accessTokens=Access tokens
columnName=Name
flowType=Flow type
syncLDAPGroupsSuccessful=Data successfully synced {{result}}
policyEnforcementModes.PERMISSIVE=Permissive
subject=Subject DN
casubject=Certificate Authority subject DN
use=Use
defaultAdminInitiated=Default Admin-Initiated Action Lifespan
chooseAMapperType=Choose a mapper type
startTimeHelp=Defines the time before which the policy MUST NOT be granted. Only granted if the current date/time is after or equal to this value.
noGroupsInThisRealm=No groups in this realm
noGroupsInThisOrganization=No groups in this orgainization
searchUserByAttributeKeyAlreadyInUseError=Attribute key already in use
executorClientAuthenticator=Executor Client Authenticator
addWebOrigins=Add web origins
clientScopeExplain=Client scopes are a common set of protocol mappers and roles that are shared between multiple clients.
attributeNameHelp=Name of attribute to search for in assertion. You can leave this blank and specify a friendly name instead.
upAttributeNameHelp=The name of the user attribute, used to uniquely identify an attribute.
linkAccountTitle=Link account to {{provider}}
invalidateRotatedSuccess=Rotated secret successfully removed
userSessionAttributeHelp=Name of user session attribute you want to hardcode
updateSuccessIdentityProvider=Provider successfully updated
reloadKeys=Reload keys
importKeys=Import keys
useMetadataDescriptorUrl=Use metadata descriptor URL
useMetadataDescriptorUrlHelp=If the switch is on, the certificates to validate signatures will be downloaded and cached from the given "Metadata descriptor URL". The "Reload keys" action can be used to refresh the certificates in the cache. If the switch is off, certificates from "Validating X509 certificates" option are used, they need to be manually updated when changed in the IDP.
samlClientUseMetadataDescriptorUrl=Use metadata descriptor URL
samlClientUseMetadataDescriptorUrlHelp=If this option is enabled, the keys to validate signatures and encrypt assertions will be downloaded and cached from the given "Metadata descriptor URL". If the option is disabled, the keys should be manually generated or imported in the "Keys" tab.
metadataDescriptorUrl=Metadata descriptor URL
metadataDescriptorUrlHelp=External URL where Identity Provider publishes the metadata information needed by the client (certificates, keys, other URLs,...).
samlClientMetadataDescriptorUrl=Metadata descriptor URL
samlClientMetadataDescriptorUrlHelp=External URL where Service Provider publishes the metadata information needed by the server (certificates, keys, other URLs,...).
reloadKeysSuccess=Keys successfully reloaded
reloadKeysError=Error reloading keys. {{error}}
reloadKeysSuccessButFalse=The reload was not executed, maybe the time between request was too short.
importKeysSuccess=Keys successfully re-imported. Please save the provider to store the new certificates.
importKeysError=Error importing keys. {{error}}
importKeysErrorNoSigningCertificate=The option "signingCertificate" is not defined in the metadata.
host=Host
forbidden_one=Forbidden, permission needed\:
backchannelLogoutRevokeOfflineSessions=Backchannel logout revoke offline sessions
supportedApplications=Supported applications
shortVerificationUriTooltipHelp=If set, this value will be returned as verification_uri in the Device Authorization flow. This uri needs to redirect to {server-root}/realms/{realm}/device.
kerberosPrincipal=Kerberos Principal
resourceAttribute=Resource attribute
addressClaim.region.label=User Attribute Name for Region
applyToResourceTypeFlagHelp=Specifies if this permission should be applied to all resources with a given type. In this case, this permission will be evaluated for all instances of a given resource type.
managePriorityInfo=Priority is the order of providers when doing a user lookup. You can drag the row handlers to change the priorities.
deletedErrorIdentityProvider=Could not delete the provider {{error}}
included.custom.audience.tooltip=This is used only if 'Included Client Audience' is empty. The specified value is included in the audience (aud) field of the token. If the token already contains audiences, the specified value is added to those audiences, without overriding them.
includeInIdToken.label=Add to ID token
steps=Steps
tokenDeleteConfirm=Are you sure you want to permanently delete the initial access token {{id}}
flowCreateError=Could not create flow\: {{error}}
readTimeoutHelp=LDAP read timeout in milliseconds. This timeout applies for LDAP read operations.
registrationAccessTokenHelp=The registration access token provides access for clients to the client registration service.
host-sending-registration-request-must-match.tooltip=If on, any request to Client Registration Service is allowed just if it was sent from some trusted host or domain.
profilesConfigTypes.formView=Form view
validatorDeletedSuccess=Success\! User Profile configuration has been saved.
canonicalization=Canonicalization method
deleteConfirmTitle=Delete realm?
includeInAccessTokenResponse.label=Add to access token response
SSOSessionMax=SSO Session Max
clientScope=Client scope
inheritedFrom=Inherited from
clientScopeSearch.name=Name
deleteConditionSuccess=The condition has been deleted
deleteConditionError=Failed to delete condition\: {{error}}
clientProfile=Client profile details
syncAllUsers=Sync all users
allowedClockSkewHelp=Clock skew in seconds that is tolerated when validating identity provider tokens. Default value is zero.
disableConfirmIdentityProvider=Are you sure you want to disable the provider '{{provider}}'?
clientSaveError=Client could not be updated\: {{error}}
tokenSaveError=Could not create initial access token {{error}}
certificate=Certificate
deleteConfirmExecutionMessage=Are you sure you want to permanently delete the execution "<1>{{name}}</1>".
offlineSessionMaxLimitedHelp=Enable offline session maximum lifetime
delete=Delete
userGroupsRetrieveStrategyHelp=Specify how to retrieve groups of user. LOAD_GROUPS_BY_MEMBER_ATTRIBUTE means that roles of user will be retrieved by sending LDAP query to retrieve all groups where 'member' is our user. GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE means that groups of user will be retrieved from 'memberOf' attribute of our user or from the other attribute specified by 'Member-Of LDAP Attribute'.
hour=Hour
connectionTimeoutHelp=LDAP connection timeout in milliseconds
repeat=Repeat
repeatHelp=Specifies how the policy time restriction is defined. If 'Not Repeat', the policy is granted only between the start and expire times. If 'Repeat', you can additionally restrict the policy to specific recurring time periods such as month, day, hour, and minute ranges.
defaultSigAlgHelp=Default algorithm used to sign tokens for the realm
save-admin-eventsHelp=If enabled, admin events are saved to the database, which makes events available to the Admin UI.
policyGroupsHelp=Specifies which user(s) are allowed by this policy.
searchForProtocol=Search protocol mapper
eventTypes.CLIENT_INFO.name=Client info
eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.description=OAuth2 device code to token
eventTypes.UPDATE_TOTP_ERROR.name=Update totp error
client-updater-source-groups.tooltip=Name of groups to check. The condition evaluates to true if the entity who creates or updates the client is a member of one or more of the specified groups. Configured groups are specified by their simple name, which must match the name of the Keycloak group. No support for group hierarchy is used here.
webAuthnPolicyRpId=Relying party ID
ldapRolesDnHelp=LDAP DN where roles of this tree are saved. For example, 'ou\=finance,dc\=example,dc\=org'.
serviceAccount=Service account roles
standardTokenExchangeEnabled=Standard Token Exchange
jwtAuthorizationGrantEnabled=JWT Authorization Grant
jwtAuthorizationGrantIdp=Allowed Identity Providers for JWT Authorization Grant
externalTokenEnabled=Allow retrieve external tokens
externalTokenEnabledHelp=If enabled the client is allowed to retrieve external tokens from the Identity Provider
externalTokenIdp=Allowed Identity Providers for External Tokens
externalTokenIdpHelp=Select the Identity Providers from which external tokens can be retrieved.
enableRefreshRequestedTokenType=Allow refresh token in Standard Token Exchange
providerUpdatedSuccess=Client policy updated successfully
assertionConsumerServiceRedirectBindingURL=Assertion Consumer Service Redirect Binding URL
createClientScopeError=Could not create client scope\: '{{error}}'
deleteRole=Delete this role
SSOSessionSettings=SSO Session Settings
directAccessHelp=This enables support for Direct Access Grants, which means that client has access to username/password of user and exchange it directly with Keycloak server for access token. In terms of OAuth2 specification, this enables support of 'Resource Owner Password Credentials Grant' for this client.
groupHelp=Group to add the user in. Fill the full path of the group including path. For example\: '/root-group/child-group'.
clientPolicyNameHelp=Display name of the policy
clientPolicyModeHelp=Mode of the client policy. In the mode 'DEFAULT', at least one condition must evaluate to `yes`. None of the conditions must evaluate to `no`. Conditions, which evaluate to `abstain` are ignored. In the 'STRICT' mode, all conditions must evaluate to 'yes' in order for the policy to be applied.
addressClaim.country.label=User Attribute Name for Country
downloadType=this is information about the download type
clustering=Clustering
createSuccess=Identity provider successfully created
mapperAttributeName=Attribute Name
setPassword=Set password
client-updater-source-roles.tooltip=The condition is checked during client registration or update request; it evaluates to true if the entity (usually a user) is creating or updating client is a member of the specified role. To reference the realm role, you can use the realm role name such as 'my_realm_role'. To reference the client role, you can use the client_id.role_name; for example, 'my_client.my_client_role' refers to the client role 'my_client_role' of the client 'my_client'.
createRole=Create role
clientDeletedSuccess=The client has been deleted
eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.description=Identity provider response error
editModeLdapHelp=READ_ONLY is a read-only LDAP store. WRITABLE means data will be synced back to LDAP on demand. UNSYNCED means user data will be imported, but not synced back to LDAP.
enableServiceAccount=Enable service account roles
signOutAllActiveSessionsQuestion=Sign out all active sessions?
addPostLogoutRedirectUri=Add valid post logout redirect URIs
SSOSessionMaxRememberMe=SSO Session Max Remember Me
pkceMethod=PKCE Method
noRoles-users=No roles for this user
showInheritedRoles=Show inherited roles
moveGroupEmptyInstructions=There are no sub groups, select 'Move here' to move the selected group as a subgroup of this group
hmacGenerated=hmac-generated
unlockSuccess=User successfully unlocked
unlockError=Could not unlock user due to {{error}}
hourHelp=Defines the hour when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if the current hour is between or equal to the two values you provided.
deleteClientProfileConfirmTitle=Delete profile?
syncLDAPGroupsError=Data could not be synced due {{error}}
saveSuccess=User federation provider successfully saved
generatedAccessToken=Generated access token
resetPasswordConfirmation=New password confirmation
testConnection=Test connection
archiveFormat=Archive format
requestObjectEncryptionHelp=JWE algorithm, which a client needs to use when sending an OIDC request object specified by 'request' or 'request_uri' parameters. If set to 'any', encryption is optional and any algorithm is allowed.
importSuccess=New certificate imported
attributeConsumingServiceName=Attribute Consuming Service Name
invalidJsonError=Unable to save user profile, the provided information is not valid JSON: {{error}}
invalidJsonClientProfilesError=Unable to save client profiles, the provided information is not valid JSON: {{error}}
invalidJsonClientPoliciesError=Unable to save client policies, the provided information is not valid JSON: {{error}}
promptHelp=Specifies whether the Authorization Server prompts the End-User for re-authentication and consent.
deleteBtn=Delete
defaultLocale=Default locale
addLdapWizardDescription=Text needed here
aggregate.attrs.label=Aggregate attribute values
removedGroupMembershipError=Error removing group membership: {{error}}
allowPasswordAuthenticationHelp=Enable/disable possibility of username/password authentication against Kerberos database
deleteExecutorSuccess=Success\! The executor was deleted.
eventTypes.SEND_RESET_PASSWORD_ERROR.name=Send reset password error
eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.name=Identity provider first login
noRoles-groups=No roles for this group
enableSwitchSuccess={{switch}} changed successfully
eventTypes.INTROSPECT_TOKEN_ERROR.name=Introspect token error
usernameHelperText=Enter the username of the user for this identity provider.
includeInAccessToken.tooltip=Should the claim be added to the access token?
noScopeCreateHint=You'll need to create an authorization scope first.
eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.name=Client initiated account linking error
clientScopesCondition=Expected Scopes
backchannelLogoutSessionRequiredHelp=Specifying whether a sid (session ID) Claim is included in the Logout Token when the Backchannel Logout URL is used.
global=Global
userAttributeHelp=Name of user attribute you want to hardcode
searchForMapper=Search for mapper
oidcCibaGrantHelp=This enables support for OIDC CIBA Grant, which means that the user is authenticated via some external authentication device instead of the user's browser.
includeOneTimeUseCondition=Include OneTimeUse Condition
clientUpdaterSourceRoles=Updating entity role
enableSwitchError=Could not enable / disable due to {{error}}
deleteClientPolicyProfileConfirm=This action will permanently delete {{profileName}} from the policy {{policyName}}. This cannot be undone.
deleteExecutorProfileConfirm=The action will permanently delete {{executorName}}. This cannot be undone.
confirmClientSecretBody=If you regenerate the secret, the Keycloak database will be updated and you will need to download a new adapter for this client.
keysList=Keys list
generatedSamlResponse=Generated SAML response
generatedSamlResponseIsDisabled=Generated SAML response is disabled when no user is selected
generatedSamlResponseNo=No generated SAML response
generatedUserInfo=Generated user info
clientRegistration=Client registration
masterSamlProcessingUrl=Master SAML Processing URL
samlIdentityProviderMetadata=SAML 2.0 Identity Provider Metadata
importParseError=Could not parse the file {{error}}
validTo=Valid to
addMember=Add member
eventTypes.CLIENT_INFO_ERROR.name=Client info error
scopeParameterHelp=You can copy the value of the scope parameter and paste it in the initial OpenID Connect Authentication Request sent from this client adapter. The default client scopes and selected optional client scopes will be used when generating token issued for this client.
idTokenEncryptionKeyManagementAlgorithm=ID token encryption key management algorithm
authenticatorAttachment.not\ specified=Not specified
oidcCibaGrant=OIDC CIBA Grant
displayDescriptionHintHelp=A text that should be used as a tooltip when rendering user-facing forms.
ssoSessionIdle=Time a session is allowed to be idle before it expires. Tokens and browser sessions are invalidated when a session is expired.
searchKey=Search key
deleteClientSuccess=Client profile deleted
emptyClientScopesPrimaryAction=Add client scopes
addStepTo=Add step to {{name}}
eventTypes.AUTHREQID_TO_TOKEN_ERROR.description=Authreqid to token error
deleteAttributeConfirm=Are you sure you want to permanently delete the attribute {{attributeName}} and its corresponding translations?
chooseResources=Choose the resources you want to import
selectOne=Select an option
emailTheme=Email theme
eventTypes.UPDATE_PASSWORD.description=Update password
policiesConfigTypes.jsonEditor=JSON editor
eventConfigSuccessfully=Successfully saved configuration
scopePermissions.users.impersonate-description=Policies that decide if administrator can impersonate other users
deleteResourceWarning=The permissions below will be removed when they are no longer used by other resources\:
permissionScopesHelp=Specifies that this permission must be applied to one or more scopes.
moveTo=Move to
registerNodeManually=Register node manually
redirectURI=Redirect URI
publicKeys=Public keys
publicKey=Public key
emptyEventsInstructions=There are no more events types left to add
periodicFullSync=Periodic full sync
removeConfirmTitle_other=Remove groups?
emptyBuiltInMappersInstructions=All built in mappers were added to this client
assertionLifespanHelp=Lifespan set in the SAML assertion conditions. After that time the assertion will be invalid. The "SessionNotOnOrAfter" attribute is not modified and continue using the "SSO Session Max" time defined at realm level.
noTokensInstructions=You haven't created any initial access tokens. Create an initial access token by clicking "Create".
editUsername=If enabled, the username field is editable, readonly otherwise.
ldapAttributeValueHelp=Value of the LDAP attribute, which will be added to the new user during registration. You can either hardcode any value like 'foo' but you can also use some special tokens. Only supported token right now is '${RANDOM}', which will be replaced with some randomly generated string.
lastRegistration=Last registration
advancedSettingsOpenid-connect=This section is used to configure advanced settings of this client related to OpenID Connect protocol
requireSsl=Require SSL
reevaluate=Re-evaluate
clientOfflineSessionMax=Client Offline Session Max
eventTypes.SEND_VERIFY_EMAIL.description=Send verify email
eventTypes.REVOKE_GRANT_ERROR.description=Revoke grant error
descriptionLanding=This is the description for the user federation landing page
moveHere=Move here
noKeys=No keys
batchSizeHelp=Count of LDAP users to be imported from LDAP to Keycloak within a single transaction
createClientConditionSuccess=Condition created successfully.
kerberosKeyTab=Kerberos Key Tab
principalAttribute=Principal attribute
userRegistrationHelpText=Enable/disable the registration page. A link for registration will show on the login page too.
activeHelp=Set if the keys can be used for signing
addMapperExplain=If you want more fine-grain control, you can create protocol mapper on this client
realmRoles=Realm roles
fineGrainOpenIdConnectConfigurationHelp=This section is used to configure advanced settings of this client related to OpenID Connect protocol.
searchForUserDescription=This realm may have a federated provider. Viewing all users may cause the system to slow down, but it can be done by searching for "*". Please search for a user above.
expirationHelp=Sets the expiration for events. Expired events are periodically deleted from the database.
webAuthnPolicySignatureAlgorithmsHelp=The signature algorithms that should be used for the Authentication Assertion.
setToNowError=Error\! Failed to set notBefore to current date and time: {{error}}
eventTypes.UNREGISTER_NODE_ERROR.description=Unregister node error
clientScopeTypes.optional=Optional
nameIdFormat=Name ID format
eventTypes.SEND_VERIFY_EMAIL_ERROR.name=Send verify email error
addTranslationSuccess=Success\! The translation has been added.
validRedirectUri=Valid redirect URIs
webauthnIntro=What is this form used for?
wantAssertionsEncryptedHelp=Indicates whether this service provider expects an encrypted Assertion.
roleObjectClasses=Role object classes
deleteClientScope_other=Delete {{count}} client scopes
deleteCredentialsConfirmTitle=Delete credentials?
expires=Expires
OVERWRITE=Overwrite
user-clearEventsHelp=Deletes all user events in the database.
eventTypes.REFRESH_TOKEN.name=Refresh token
userAttribute=User Attribute
revoke=Revoke
admin=Admin
syncUsersError=Could not sync users\: '{{error}}'
generatedAccessTokenHelp=See the example access token, which will be generated and sent to the client when the selected user is authenticated. You can see claims and roles that the token will contain based on the effective protocol mappers and role scope mappings and also based on the claims and roles assigned to the actual user.
webAuthnPolicyAcceptableAaguidsHelp=The list of allowed AAGUIDs of which an authenticator can be registered. An AAGUID is a 128-bit identifier indicating the authenticator's type (e.g., make and model). This option needs the Attestation conveyance preference to be configured (normally `Direct`) to ensure a trusted AAGUID is passed. Default attestation `None` is not reliable, and can anonymize the AAGUID to zero value.
keyPasswordHelp=Password for the private key
frontchannelLogout=Front channel logout
logoutConfirmation=Logout confirmation
logoutConfirmationHelp=After the user logs out (OIDC RP-Initiated Logout), an additional confirmation page will be displayed showing a message such as 'You are logged out' before redirecting the user to the post-logout landing page. On this page, the user must confirm that they want to be redirected to the post-logout landing page.
titleRoles=Realm roles
sectorIdentifierUri.tooltip=Providers that use pairwise sub values and support Dynamic Client Registration SHOULD use the sector_identifier_uri parameter. It provides a way for a group of websites under common administrative control to have consistent pairwise sub values independent of the individual domain names. It also provides a way for Clients to change redirect_uri domains without having to reregister all their users.
eventTypes.REVOKE_GRANT.name=Revoke grant
rdnLdapAttribute=RDN LDAP attribute
usedBy=Used by
replyToDisplayName=Reply to display name
xRobotsTag=X-Robots-Tag
bindType=Bind type
tokenDeleteSuccess=Initial access token deleted successfully
contextualInfo=Contextual Information
syncModeHelp=Default sync mode for all mappers. The sync mode determines when user data is synced using the mappers. Three possible values exist\: 'legacy' to keep the behavior before this option was introduced, 'import' to import the user only once, specifically during the first login of the user with this identity provider, and force' to always update the user at every login with this identity provider.
temporaryPassword=Temporary
applyPolicyHelp=Specifies all the policies that must be applied to the scopes defined by this policy or permission.
addKerberosWizardDescription=Text needed here
sslType.none=None
dateTo=Date(to)
eventTypes.REVOKE_GRANT.description=Revoke grant
keyPlaceholder=Type a key
eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.name=OAuth2 device verify user code error
addAuthnContextDeclRef=Add AuthnContext DeclRef
eventTypes.SEND_IDENTITY_PROVIDER_LINK.description=Send identity provider link
eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN.name=Identity provider retrieve token
userInfo=User info
consentScreenText=Consent screen text
addRoles=Add roles
clientPoliciesProfilesHelpText=Client Profile allows creating a set of executors that enforce various actions that are done with the client. Actions can be admin actions such as creating or updating a client or user actions such as authentication to the client.
archiveFormatHelp=Java keystore or PKCS12 archive format.
xContentTypeOptions=X-Content-Type-Options
groupsDescription=A group is a set of attributes and role mappings that can be applied to a user. You can create, edit, and delete groups and manage their child-parent relationships.
orgGroupsDescription=A group is a set of attributes that can be applied to a user. You can create, edit, and delete groups and manage their child-parent relationships.
addValidatorRole=Add {{validatorName}} validator
protocolTypes.all=All
keyAlias=Key alias
xContentTypeOptionsHelp=The default value prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type. <formattedlink>Learn more</formattedlink>
privateKeyMask=PRIVATE KEY NOT SET UP OR KNOWN
signOutAllActiveSessions=Sign out all active sessions
addExecutorSuccess=Success\! Executor created successfully
executorTypeSelectHelpText=Executor Type Select Help Text
useDiscoveryEndpointHelp=If this setting is enabled, the discovery endpoint will be used to fetch the provider config. Keycloak can load the config from the endpoint and automatically update the config if the source has any updates.
eventTypes.USER_INFO_REQUEST_ERROR.name=User info request error
createUserProviderError=User federation provider could not be created\: {{error}}
learnMore=Learn more
onDragCancel=Dragging cancelled. List is unchanged.
removeUser=Remove users
ownerManagedAccess=User-Managed access enabled
eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT.description=User disabled by permanent lockout
eventTypes.USER_DISABLED_BY_PERMANENT_LOCKOUT_ERROR.description=User disabled by permanent lockout error
eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT.description=User disabled by temporary lockout
eventTypes.USER_DISABLED_BY_TEMPORARY_LOCKOUT_ERROR.description=User disabled by temporary lockout error
userModelAttributeNameHelp=Name of the model attribute to be added when importing user from LDAP
templateHelp=Template to use to format the username to import. Substitutions are enclosed in ${}. For example\: '${ALIAS}.${CLAIM.sub}'. ALIAS is the provider alias. CLAIM.<NAME> references an ID or Access token claim. The substitution can be converted to upper or lower case by appending |uppercase or |lowercase to the substituted value, for example, '${CLAIM.sub | lowercase}.
permissions=Permissions
emptyExecutionInstructions=You can start defining this flow by adding a sub-flow or an execution
offlineSessionSettings=Offline session settings
unAssignRole=Unassign
deleteScope=Permanently delete authorization scope?
eventTypes.CODE_TO_TOKEN.description=Code to token
oAuthDevicePollingIntervalHelp=The minimum amount of time in seconds that the client should wait between polling requests to the token endpoint.
passwordDataTitle=Password data
accountThemeHelp=Select a theme for the user account management console.
clientPolicies=Client policies
NONE=NONE
keystorePasswordHelp=Password for the keystore
clientSettings=Client details
deleteClientPolicyConditionConfirm=This action will permanently delete {{condition}}. This cannot be undone.
selectATheme=Select a theme
themeColors=Theme colors
defaults=Reset to defaults
quickTheme=Quick Theme
themeMode=Theme mode
lightMode=Light
darkMode=Dark
themePreviewInfo=In order to preview the theme colors, the current theme needs to be set to the one you want to preview, so we have automatically switched you to the one you want to preview.
backgroundImage=Login background image
favicon=Favicon
errorColor=Error color
successColor=Success color
activeColor=Active color
primaryColor=Primary color
primaryColorHover=Primary color hover
secondaryColor=Secondary color
linkColor=Link color
linkColorHover=Link color hover
backgroundColorAccent=Background color accent
backgroundColor=Background color
backgroundColorNav=Background color navigation
backgroundColorHeader=Background color header
iconColor=Icon color
textColor=Text color
lightTextColor=Light text color
inputBackgroundColor=Input background color
inputTextColor=Input text color
permissionsList=Permission list
attributeGroupHelp=Specifies the user profile group where this attribute will be added. This allows grouping various similar attributes together on different parts of the screen when creating or updating user.
createRealm=Create realm
eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.description=Validate access token error
mapperSaveError=Error saving mapper\: {{error}}
eventTypes.CLIENT_LOGIN_ERROR.name=Client login error
passwordPoliciesHelp.passwordHistory=Prevents a recently used password from being reused.
displayOnConsentScreenHelp=If on, and this client scope is added to some client with consent required, the text specified by 'Consent Screen Text' will be displayed on consent screen. If off, this client scope will not be displayed on the consent screen.
alwaysDisplayConsentHelp=When enabled, user consent for this scope is never saved to the database. The consent screen will appear on every authentication, requiring the user to approve access each time. Only clients with "Consent Required" enabled can use this scope. Requests from clients without consent requirements will return an error. When disabled, standard behavior applies, user consent is saved and reused across sessions.
requirements.DISABLED=Disabled
titleUsers=Users
whoWillAppearLinkText=Who will appear in this group list?
ldapFullNameAttribute=LDAP full name attribute
createClientError=Could not create client\: '{{error}}'
deleteConfirmClientScopes=Are you sure you want to delete this client scope?
forceAuthenticationHelp=Indicates whether the identity provider must authenticate the presenter directly rather than rely on a previous security context.
testClusterAvailability=Test cluster availability
reGenerateSigning=Regenerate signing key for this client
reGenerateEncryption=Regenerate encryption key for this client
authorizationEncryptedResponseAlgHelp=JWA Algorithm used for key management in encrypting the authorization response when the response mode is jwt. This option is needed if you want encrypted authorization response. If left empty, the authorization response is just signed, but not encrypted.
deleteConfirmGroup_other=Are you sure you want to delete these groups?
scopePermissions.users.manage-description=Policies that decide if an administrator can manage all users in the realm
defaultACRValuesHelp=Default values to be used as voluntary ACR in case that there is no explicit ACR requested by 'claims' or 'acr_values' parameter in the OIDC request.
minimumACRValueHelp=Minimum ACR to be enforced by Keycloak. Overrides lower ACRs explicitly requested by 'acr_values' or 'claims', unless they are marked as essential.
minimumACRValueSamlHelp=Minimum ACR to be enforced by Keycloak. If the resulting authentication context for the request is as strong as this ACR the request is valid, otherwise Keycloak returns the NoAuthnContext status error.
membershipAttributeType=Membership attribute type
eventTypes.PUSHED_AUTHORIZATION_REQUEST.name=Pushed authorization request
included.client.audience.tooltip=The Client ID of the specified audience client will be included in the audience (aud) field of the token. If the token includes audiences, the specified value is added to them. It will not override existing audiences.
searchGroup=Search group
allowCreateHelp=Allow the external identity provider to create a new identifier to represent the principal.
allResults=All results
addressClaim.locality.tooltip=Name of User Attribute, which will be used to map to the 'locality' subclaim inside the 'address' token claim. Defaults to 'locality'.
keyForCodeExchangeHelp=Choose the PKCE challenge method. S256 (recommended) uses SHA-256 hashing for enhanced security. Plain sends the code verifier without hashing and should only be used if the client cannot support SHA-256.
includeInAccessTokenResponse.tooltip=Should the claim be added to the access token response? Should only be used for informative and non-sensitive data
removeMappingConfirm_one=Are you sure you want to remove this role?
oidcSettings=OpenID Connect settings
oAuthSettings=OAuth2 settings
otpPolicyDigitsHelp=How many digits should the OTP have?
clientAuthentications.client_secret_post=Client secret sent in the request body
prompts.select_account=Select account
defaultACRValues=Default ACR Values
minimumACRValue=Minimum ACR Value
valueError=A value must be provided.
loa=LoA
uri=URI
acr=ACR
loaError=Invalid LoA
uriError=Invalid URI
acrError=Invalid ACR
loaPlaceholder=Type a LoA
uriPlaceholder=Type an URI
acrPlaceholder=Type an ACR
noConsents=No consents
orderChangeSuccessUserFed=Successfully changed the priority order of user federation providers
noUsersEmptyStateDescriptionContinued=to find them. Users that already have this role as an effective role cannot be added here.
userProviderSaveError=User federation provider could not be saved\: {{error}}
executorsHelpText=Executors, which will be applied for this client profile
ldapSearchingAndUpdatingSettings=LDAP searching and updating
authenticationAliasHelp=Name of the configuration
SSOSessionIdle=SSO Session Idle
deleteClientPolicyConditionConfirmTitle=Delete condition?
initialCounterErrorHint=Value needs to be between 1 and 120
connectionTimeout=Connection timeout
passLoginHintHelp=Pass login_hint to identity provider.
monthHelp=Defines the month which the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if current month is between or equal to the two values you provided.
eventTypes.CLIENT_LOGIN.description=Client login
registrationAccessToken=Registration access token
headerName=header name
issuerHelp=The issuer identifier for the issuer of the response. If not provided, no validation will be performed.
uiDisplayNameHelp=Display name of provider when linked in the Admin UI
titleSessions=Sessions
dedicatedScopeName={{clientName}}-dedicated
deleteAttributeConfirmTitle=Delete attribute?
importSkipped_zero=No records skipped.
rootURL=Root URL appended to relative URLs
contentSecurityPolicyHelp=Default value prevents pages from being included by non-origin iframes. <formattedlink>Learn more</formattedlink>
policyUsers=Specifies which user(s) are allowed by this policy.
logoutServicePostBindingURLHelp=SAML POST Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.
generatedIdTokenNo=No generated id token
byConfiguration=By configuration
usersAdded_other={{count}} users added to the group
userFedUnlinkUsersConfirmTitle=Unlink all users?
passCurrentLocale=Pass current locale
realmNameField=Realm name
roleCreated=Role created
socialProfileJSONFieldPath=Social Profile JSON Field Path
noViewRights=You do not have rights to view this group.
eventTypes.SEND_RESET_PASSWORD.description=Send reset password
eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.name=Client initiated account linking
resourceScopeError=Could not remove the authorization scope due to {{error}}
identityInformation=Identity Information
usermodel.clientRoleMapping.rolePrefix.label=Client Role prefix
partialImport=Partial import
cibaBackhannelTokenDeliveryModes.ping=Ping
includeInTokenScopeHelp=If on, the name of this client scope will be added to the access token property 'scope' as well as to the Token Introspection Endpoint response. If off, this client scope will be omitted from the token and from the Token Introspection Endpoint response.
savePassword=Save password
noRolesInstructions-users=You haven't assigned any roles to this user. Assign a role to get started.
signatureKeyNameHelp=Signed SAML documents contain identification of signing key in KeyName element. For Keycloak / RH-SSO counterparty, use KEY_ID, for MS AD FS use CERT_SUBJECT, for others check and use NONE if no other option works.
sync-keycloak-roles-to-ldap=Sync Keycloak roles to LDAP
decisionStrategies.UNANIMOUS=Unanimous
cacheSettingsDescription=This section contains options useful for caching users, which were loaded from this user storage provider.
groupsPathHelp=Keycloak group path the LDAP groups are added to. For example if value '/Applications/App1' is used, then LDAP groups will be available in Keycloak under group 'App1', which is child of top level group 'Applications'. The default value is '/' so LDAP groups will be mapped to the Keycloak groups at the top level. The configured group path must already exist in the Keycloak when creating this mapper.
aesGenerated=aes-generated
addPolicy=Add policy
tokenClaimName.label=Token Claim Name
executorsTable=Executors table
extendToChildren=Extend to children
from=From
decisionStrategyHelp=The decision strategy dictates how permissions are evaluated and how a final decision is obtained. 'Affirmative' means that at least one permission must evaluate to a positive decision in order to grant access to a resource and its scopes. 'Unanimous' means that all permissions must evaluate to a positive decision in order for the final decision to be also positive.
deleteClientPolicyProfileError=Could not delete profile from the policy\: {{error}}
greaterThan=Must be greater than {{value}}
hideOnLoginPage=Hide on login page
couldNotCreateGroup=Could not create group {{error}}
defaultRole=This role serves as a container for both realm and client default roles. It cannot be removed.
eventConfigs=Event configs
conditionsHelp=Conditions, which will be evaluated to determine if client policy should be applied during particular action or not.
disableProvider=Disable provider?
eventTypes.UNREGISTER_NODE.name=Unregister node
anonymousAccessPoliciesHelp=Those Policies are used when the Client Registration Service is invoked by unauthenticated request. This means that the request does not contain Initial Access Token nor Bearer Token.
clientScopeError=Could not update scope mapping {{error}}
saveRealmSuccess=Realm created successfully
createToken=Create initial access token
clientsClientTypeHelp='OpenID Connect' allows Clients to verify the identity of the End-User based on the authentication performed by an Authorization Server.'SAML' enables web-based authentication and authorization scenarios including cross-domain single sign-on (SSO) and uses security tokens containing assertions to pass information.
orderChangeSuccess=Successfully changed display order of identity providers
emptyPoliciesInstructions=If you want to create a policy, please click the button below to create the policy.
createScopeSuccess=Authorization scope created successfully
logoUrl=Logo URL
accessTokenLifespanImplicitFlowHelp=Max time before an access token issued during OpenID Connect Implicit Flow is expired. This value is recommended to be shorter than the SSO timeout. There is no possibility to refresh token during implicit flow, that's why there is a separate timeout different to 'Access Token Lifespan'.
noRealmRolesToAssign=There are no realm roles to assign
logoutUrl=Logout URL
regexPatternHelp=Specifies the regex pattern.
searchForUserEvent=Search user event
usernameLdapAttributeHelp=Name of the LDAP attribute, which is mapped as Keycloak username. For many LDAP server vendors it can be 'uid'. For Active directory it can be 'sAMAccountName' or 'cn'. The attribute should be filled for all LDAP user records you want to import from LDAP to Keycloak.
federationLink=Federation link
webAuthnPolicyPasswordlessFormHelp=Policy for passwordless WebAuthn authentication. This policy is used by the 'WebAuthn Register Passwordless' required action and 'WebAuthn Passwordless Authenticator' authenticator. A typical usage is when WebAuthn is used as first-factor authentication. Having both 'WebAuthn Policy' and 'WebAuthn Passwordless Policy' allows using WebAuthn as both first factor and second factor authenticator in the same realm.
unlinkUsersError=Could not unlink users\: '{{error}}'
roleHelpHelp=Role to grant to user. Click 'Select Role' button to browse roles, or just type it in the textbox. To reference an application role the syntax is appname.approle, i.e. myapp.myrole.
storedTokensReadable=Stored tokens readable
defaultRoleDeleteError=You cannot delete a default role.
unknownUser=Anonymous
displayHeader=Display name
userVerify.not\ specified=Not specified
usermodel.prop.label=Property
userFedUnlinkUsersConfirm=Do you want to unlink all the users? Any users without a password in the database will not be able to authenticate anymore.
searchUserByAttributeDescription=It supports setting multiple attributes as the search filter by setting different keys or values. Only one value can be typed for a key.
eventTypes.REMOVE_FEDERATED_IDENTITY.name=Remove federated identity
membership=Membership
eventTypes.RESET_PASSWORD.description=Reset password
authenticationOverrides=Authentication flow overrides
client-scopes-condition.label=Expected Scopes
deleteAttributeSuccess=Attribute deleted
artifactResolutionService=Artifact Resolution Service
clientProfilesSubTab=Client profiles subtab
selectEncryptionType=Select Encryption type
realmSettingsExplain=Realm settings are settings that control the options for users, applications, roles, and groups in the current realm.
mappingUpdatedError=Could not update mapping\: '{{error}}'
manageDisplayOrder=Manage display order
emptyRealmBasedIdps=No realm based identity providers are configured for this realm.
hideOrganizationLinkedIdps=Hide organization linked identity providers
exactSearch=Exact search
value=Value
filenamePlaceholder=Upload a PEM file or paste key below
deleteConfirm_one=Are you sure you want to delete this group '{{groupName}}'.
scopeDisplayNameHelp=A unique name for this scope. The name can be used to uniquely identify a scope, useful when querying for a specific scope.
times.seconds=Seconds
removeMappingTitle=Remove role?
executorTypeSelectAlgorithm=Executor Type Select Algorithm
resources=Resources
userRolesRetrieveStrategy=User roles retrieve strategy
importKey=Import key
events-disable-title=Unsave events?
ellipticCurve=Elliptic Curve
forceArtifactBindingHelp=Should response messages be returned to the client through the SAML ARTIFACT binding system?
forceAuthentication=Force authentication
connectionPoolingHelp=Determines if Keycloak should use connection pooling for accessing LDAP server. Connection pooling cannot be used if StartTLS is enabled.
unlink=Unlink
groupRemove_other=Groups removed
claimFilterName=Essential claim
deletePolicy=Permanently delete policy?
assertionConsumerServiceRedirectBindingURLHelp=SAML Redirect Binding URL for the client's assertion consumer service (login responses). You can leave this blank if you do not have a URL for this binding.
searchFor=Search role by name
add-providers=Add providers
providers=Providers
writeOnly=Write only
noRolesInstructions-clientScopes=You haven't created any roles for this client scope. Create a role to get started.
noRolesInstructions-clients=You haven't created any roles for this client scope. Create a role to get started.
removeImportedUsersMessage=Do you really want to remove all imported users?
noGroupsInThisSubGroup=No groups in this sub group
validateUserObjectClasses=You must enter one or more user object classes
encryptionAlgorithm=Encryption Algorithm
requiredForLabel.users=Only users
groupUpdated=Group updated
hideMetaData=Hide metadata
customAttribute=Custom Attribute…
themes=Themes
clientType=Client type
addClientScope=Add client scope
notBeforeSuccess=Success\! "Not before" set for realm
clientPoliciesSubTab=Client policies subtab
quickLoginCheckMilliSecondsHelp=If a failure happens concurrently too quickly, lock out the user.
unanimous=Unanimous
policy-name=The name of this policy.
syncRegistrations=Sync Registrations
eventTypes.REMOVE_TOTP.name=Remove totp
clientHelp=Select the client making this authorization request. If not provided, authorization requests would be done based on the client you are in.
eventTypes.CLIENT_REGISTER_ERROR.name=Client register error
unlockUsersError=Could not unlock all users {{error}}
serviceProviderEntityIdHelp=The Entity ID that will be used to uniquely identify this SAML Service Provider.
disabledFeatures=Disabled features
eventTypes.UPDATE_CONSENT_ERROR.name=Update consent error
noAdminUrlSet=No push sent. No admin URI configured or no registered cluster nodes available
authData=Authorization data
realmInfo=Realm info
chooseAPolicyType=Choose a policy type
signOut=Sign out
deleteExecutorError=Could not delete executor\: {{error}}
userProfileError=Could not update user profile settings\: {{error}}
validatorDialogColNames.colName=Role name
UPDATE_PASSWORD=Update password (UPDATE_PASSWORD)
version=Version
synchronizationSettings=Synchronization settings
certificateHelp=Client Certificate for validate JWT issued by client and signed by Client private key from your keystore.
samlclientSignatureCertificateHelp=Client Certificate of public key for validate SAML requests and responses signed by SAML client.
samlencryptAssertionsCertificateHelp=Client Certificate of public key for encrypt SAML assertions.
resetPasswordError=Error resetting password\: {{error}}
associatedPermissions=Associated permission
encryptionKeysConfigExplain=If you enable the "Encrypt assertions" below, the SAML assertions will be encrypted with the client's public key. If the client provides a SP Metadata Descriptor URL with signing and encryption keys, you can enable automatic management of keys with the option "Use metadata descriptor URL" in the "Signature and Encryption" section of the "Settings" tab. You can also configure manually the encryption key by generating or importing it on activation. When this option is enabled, the encryption details can be modified in the "Settings" tab, section "Signature and Encryption".
preserveGroupInheritanceHelp=Flag whether group inheritance from LDAP should be propagated to Keycloak. If false, then all LDAP groups will be mapped as flat top-level groups in Keycloak. Otherwise group inheritance is preserved into Keycloak, but the group sync might fail if LDAP structure contains recursions or multiple parent groups per child groups.
createScopeBasedPermission=Create scope-based permission
showMore=Show more
showMoreUsers=Show more users
operationType=Operation type
userInitiatedActionLifespan=User-Initiated Action Lifespan
decisionStrategy=Decision strategy
roleMappingUpdatedSuccess=Role mapping updated
securityDefences=Security defenses
realmSettings=Realm settings
emptyStateInstructions=If you want to add an attributes group click the button below.
logoutAllSessionsError=Error\! Failed to log out of all sessions\: {{error}}.
eventTypes.VERIFY_EMAIL_ERROR.name=Verify email error
partialExport=Partial export
eventTypes.CLIENT_REGISTER.description=Client register
generalOptions=General options
decisionStrategies.AFFIRMATIVE=Affirmative
helpEnabled=Help on
defaultGroupsHelp=Default groups allow you to automatically assign groups membership whenever any new user is created or imported through <1>identity brokering</1>.
times.years=Years
userLdapFilterHelp=Additional LDAP filter for filtering searched users. Leave this empty if you don't need an additional filter. Make sure that it starts with '(' and ends with ')'.
generatedIdToken=Generated ID token
effectiveRoleScopeMappings=Effective role scope mappings
clientAuthenticator=Client Authenticator
importAdded_other={{count}} records added.
oAuthDeviceCodeLifespanHelp=Max time before the device code and user code are expired. This value needs to be a long enough lifetime to be usable (allowing the user to retrieve their secondary device, navigate to the verification URI, login, etc.), but should be sufficiently short to limit the usability of a code obtained for phishing.
parameterizedScopeHelp=If on, this scope will be considered a Parameterized Scope, which will be comprised of a static and a variable portion. Currently, parameterized scopes cannot be assigned as Default type.
parameterizedScopeDisabledInfo=This scope was previously configured as parameterized, but the Parameterized Scopes feature is currently disabled. Saving will convert it to a regular scope, or consider removing it.
attributePermissionDescription=This section contains permissions for who can edit and who can view the attribute.
providerDetails=Provider details
groupDeleteError=Error deleting group {{error}}
editGroupText=Edit attributes group
updateFirstLoginHelp=Update profile on first login
deleteGroup=Delete group
eventTypes.VERIFY_EMAIL_ERROR.description=Verify email error
close=Close
usersDNHelp=Full DN of the LDAP tree where your users exist. This DN is the parent of LDAP users. It could be for example 'ou\=users,dc\=example,dc\=com' assuming that your typical user will have a DN such as 'uid\='john',ou\=users,dc\=example,dc\=com'.
addKeycloakOpenIdProvider=Add Keycloak OpenID Connect provider
addOAuth2Provider=Add OAuth v2 provider
clientSessionMax=Client Session Max
deleteClientPolicy=Delete client policy
authenticatorAttachment.cross-platform=Cross platform
whoCanView=Who can view?
lastAccess=Last access
emptyClientScopesInstructions=There are currently no client scopes linked to this client. You can add existing client scopes to this client to share protocol mappers and roles.
clientAuthentications.private_key_jwt=JWT signed with private key
uiDisplayName=UI display name
createClientSuccess=Client created successfully
adminEventsSettings=Admin events settings
cibaInterval=Interval
totalMemory=Total memory
usernameTemplateImporter=Format the username to import.
resourceNameHelp=A unique name for this resource. The name can be used to uniquely identify a resource, useful when querying for a specific resource.
times.minutes=Minutes
disableUserInfo=Disable user info
authorizationEncryptedResponseEnc=Authorization response encryption content encryption algorithm
editCondition=Edit condition
viewCondition=View condition
ssoSessionMaxRememberMe=Max time before a session is expired when a user has set the remember me option. Tokens and browser sessions are invalidated when a session is expired. If not set it uses the standard SSO Session Max value.
forcePostBinding=Force POST binding
usersExplain=Users are the users in the current realm.
passMaxAgeHelp=Pass max_age to identity provider.
exportFail=Could not export realm\: '{{error}}'
flowTypeHelp=What kind of form is it
targetHelp=Destination field for the mapper. LOCAL (default) means that the changes are applied to the username stored in the local database upon user import. BROKER_ID and BROKER_USERNAME means that the changes are stored into the ID or username used for federation user lookup, respectively.
setPasswordConfirm=Set password?
attributeDisplayNameHelp=Display name for the attribute. Supports keys for localized values as well. For example\: ${profile.attribute.phoneNumber}. Hit the 'Globe Route' icon to add translations.
assignedType=Assigned type
modeHelp=LDAP_ONLY means that all group mappings of users are retrieved from LDAP and saved into LDAP. READ_ONLY is Read-only LDAP mode where group mappings are retrieved from both LDAP and the database and they are merged together. New group joins are not saved to LDAP but to the database. IMPORT is Read-only LDAP mode where group mappings are retrieved from LDAP when the user is imported from LDAP and then they are saved to the local Keycloak database.
identityProvider=Identity provider
forgotPasswordHelpText=Show a link on the login page for users who have forgotten their credentials.
identityProviderLinks=Identity provider links
leave=Leave
loginSettings=Login settings
deleteMessageBundleError=Error removing the message from the bundle, {{error}}
finish=Finish
eventTypes.LOGIN_ERROR.name=Login error
validations=Validations
updatedRequiredActionError=Could not update required action\: {{error}}
createChildGroup=Create child group
x509Certificate=X509 Certificate
addressClaim.formatted.label=User Attribute Name for Formatted Address
metadataOfDiscoveryEndpoint=Metadata of the discovery endpoint
add=Add
createPolicySuccess=Successfully created the policy
notVerified=Not verified
encryptionKeysConfig=Encryption keys config
updateClientProfileSuccess=Client profile updated successfully
openIDEndpointConfiguration=OpenID Endpoint Configuration
oid4vcIssuerMetadata=OpenID4VCI Credential Issuer Metadata
ssfConfigurationMetadata=SSF Configuration Metadata
prompts.login=Login
users=Users
keyTabHelp=Location of the Kerberos KeyTab file containing the credentials of the server principal. For example, /etc/krb5.keytab
wantAssertionsEncrypted=Want Assertions encrypted
noClientPoliciesInstructions=There are no client policies. Select 'Create client policy' to create a new client policy.
deleteValidatorConfirmMsg=Are you sure you want to permanently delete the validator {{validatorName}}?
uris=URIs
jwksUrlConfig=JWKS URL configs
forceNameIdFormatHelp=Ignore requested NameID subject format and use Admin UI configured one.
validateKeyTab=You must enter a key tab
editUsernameAllowed=Edit username
searchType.attribute=Attribute search
saveProviderError=Error saving provider\: {{error}}
port=Port
searchForPermission=Search for permission
ldapFilterHelp=LDAP Filter adds an additional custom filter to the whole query for retrieve LDAP groups. Leave this empty if no additional filtering is needed and you want to retrieve all groups from LDAP. Otherwise make sure that filter starts with '(' and ends with ')'.
addRequestUri=Add valid request URIs
selectACondition=Select a condition
ldapAttributeValue=LDAP attribute value
jwksUrlHelp=URL where identity provider keys in JWK format are stored. See the JWK specification for more details. If you use an external Keycloak identity provider, you can use a URL such as 'http\://broker-keycloak\:8180/realms/test/protocol/openid-connect/certs' assuming your brokered Keycloak is running on 'http\://broker-keycloak\:8180' and its realm is 'test'.
eventTypes.CLIENT_DELETE.description=Client delete
emptyResources=No resources
roleHelp=Role to grant to user if all attributes are present. Click 'Select Role' to browse roles, or just type it in the text box. To reference a client role, the syntax is clientname.clientrole, for example, myclient.myrole.
ldapSynchronizationSettingsDescription=This section contains options related to synchronization of users from LDAP to the Keycloak database.
addPredefinedMappers=Add predefined mappers
updatedRequiredActionSuccess=Updated required action successfully
roles=Roles
displayOrder=Display order
registrationAllowed=User registration
choose=Choose...
appliedByProviders=Applied by the following providers
saveEventListenersSuccess=Event listener has been updated.
eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT.description=Identity provider link account
eventTypes.TOKEN_EXCHANGE.name=Token exchange
skipped=Skipped
eventTypes.RESTART_AUTHENTICATION.description=Restart authentication
scopePermissions.users.manage-group-membership-description=Policies that decide if an administrator can manage group membership for all users in the realm. This is used in conjunction with specific group policy
loginTheme=Login theme
eventTypes.UPDATE_PASSWORD_ERROR.description=Update password error
deleteConfirmRealmSetting=If you delete a realm, all associated data will be removed.
scope=Scope
evaluateExplain=This page allows you to see all protocol mappers and role scope mappings
providerCreateError=Could not create client policy due to {{error}}
includeRepresentationHelp=Include JSON representation for create and update requests.
searchForClientScope=Search for client scope
removeAttribute=Remove attribute
deleteProviderSuccess=Success. The provider has been deleted.
sessionsType.offline=Offline
validatorDeletedError=Error saving User Profile\: {{error}}
preserveGroupInheritance=Preserve group inheritance
createClientScopeSuccess=Client scope created
selectOrTypeAKey=Select or type a key
resourceDetails=Resource details
authorizationScopes=Authorization scopes
fromDisplayNameHelp=A user-friendly name for the 'From' address (optional).
identityProviderEntityIdHelp=The Entity ID used to validate the Issuer for received SAML assertions. If empty, no Issuer validation is performed.
noRoles-client=No roles for this client
eventTypes.EXECUTE_ACTION_TOKEN_ERROR.name=Execute action token error
eventTypes.USER_INFO_REQUEST_ERROR.description=User info request error
policyRoles=Specifies the client roles allowed by this policy.
roleMapping=Role mapping
accountLinkingOnlyHelp=If true, users cannot log in through this provider. They can only link to this provider. This is useful if you don't want to allow login from the provider, but want to integrate with a provider.
refreshTokenMaxReuseHelp=Maximum number of times a refresh token can be reused. When a different token is used, revocation is immediate.
eventTypes.REMOVE_FEDERATED_IDENTITY.description=Remove federated identity
childGroups=Child groups
eventTypes.IDENTITY_PROVIDER_LOGIN.name=Identity provider login
exportAuthDetailsError=Error exporting authorization details\: {{error}}
clientOfflineSessionIdleHelp=Time a client offline session is allowed to be idle before it expires. Offline tokens are invalidated when a client offline session is expired. The option does not affect the global user SSO session. If not set, it uses the realm Offline Session Idle value.
selectGroups=Select groups to join
webAuthnPolicyAuthenticatorAttachmentHelp=Communicates to an authenticator an acceptable attachment pattern.
did=Identity (DID)
username=Username
mappedGroupAttributes=Mapped group attributes
localization=Localization
importConfig=Import config from file
replyToDisplayNameHelp=A user-friendly name for the 'Reply-To' address (optional).
webAuthnPolicyRpIdHelp=The WebAuthn Relying Party ID (RpID). It must be the origin's effective domain, e.g. 'company.com' or 'auth.company.com'.
signingKeysConfigExplain=If you enable the "Client signature required" below, the client should sign their SAML requests and responses and the signature will be validated by the server. If the client provides a SP Metadata Descriptor URL with signing and encryption keys, you can enable automatic management of keys with the option "Use metadata descriptor URL" in the "Signature and Encryption" section of the "Settings" tab. You can also configure manually the signing key by generating or importing it on activation.
newClientProfile=Create client profile
consoleDisplayConnectionUrlHelp=Connection URL to your LDAP server
enabledWhen=Enabled when
enabledWhenTooltip=Specifies when the attribute is available. When scopes are used, the attribute is available when at least one of the configured scopes is applied in the login request. Both default and optional scopes of the current request are evaluated. In the Admin Console and Account Console contexts, scopes are not evaluated and the attribute is always available (if not further restricted by permissions).
clientAssertionSigningAlg=Client assertion signature algorithm
homeURLHelp=Default URL to use when the auth server needs to redirect or link back to the client.
ldapAttribute=LDAP attribute
fullScopeAllowedHelp=Allows you to disable all restrictions.
eventTypes.SEND_IDENTITY_PROVIDER_LINK_ERROR.description=Send identity provider link error
otpType=OTP type
algorithm=Algorithm
grantedScopes=Granted scopes
groupNameLdapAttribute=Group name LDAP attribute
deleteProviderConfirm=Are you sure you want to permanently delete the key provider {{provider}}?
removeConfirmTitle_one=Remove group?
eventTypes.PUSHED_AUTHORIZATION_REQUEST_ERROR.description=Pushed authorization request error
includeInTokenScope=Include in token scope
eventType=Event saved type
tokenDeleteConfirmTitle=Delete initial access token?
useRefreshTokenForClientCredentialsGrant=Use refresh tokens for client credentials grant
userDetails=User details
sectorIdentifierUri.label=Sector Identifier URI
inputTypeStep=Input step size
mapperTypeHelp=Used to map single attribute from LDAP user to attribute of UserModel in Keycloak database
importWarning=The data and settings imported above may overwrite the data and settings that already exist.
kerberosRequiredSettingsDescription=This section contains a few basic options common to all user storage providers.
resetPasswordFor=Set password for {{username}}
duplicateEmailsAllowed=Duplicate emails
deleteEventsConfirm=If you clear all events of this realm, all records will be permanently cleared in the database
noGroupsInThisRealmInstructions=You haven't created any groups in this realm. Create a group to get started.
noGroupsInThisOrganizationInstructions=You haven't created any groups in this organization. Create a group to get started.
groupAction=Group action
eventTypes.REMOVE_TOTP_ERROR.name=Remove totp error
groupUpdateError=Error updating group {{error}}
logoutAllSessions=Logout all sessions
membershipUserLdapAttribute=Membership user LDAP attribute
noKeysDescription=You haven't created any active keys
rememberMeHelpText=Show checkbox on the login page to allow the user to remain logged in between browser restarts until the session expires. If disabled, all sessions created with the "Remember me" checkbox selected during login are considered invalid.
eventTypes.UPDATE_EMAIL.name=Update email
notBeforeHelp=Revoke any tokens issued before this time for this client. To push the policy, you should set an effective admin URL in the Settings tab first.
protocolTypes.saml=SAML
idTokenSignatureAlgorithm=ID token signature algorithm
displayHeaderHintHelp=A user-friendly name for the group that should be used when rendering a group of attributes in user-facing forms. Supports keys for localized values as well. For example\: ${profile.attribute.group.address}.
providerInfo=Provider info
ssoServiceUrl=Single Sign-On service URL
artifactResolutionServiceUrl=Artifact Resolution service URL
inputHelperTextAfter=Helper text (under) the input field
appliedByClients=Applied by the following clients
defaultLocaleHelp=The initial locale to use. It is used on the login screen and other screens in the Admin UI and Account UI.
deleteConfirmFlowMessage=Are you sure you want to permanently delete the flow "<1>{{flow}}</1>".
webAuthnPolicyAuthenticatorAttachment=Authenticator Attachment
logoutServiceSoapBindingUrlHelp=SAML SOAP Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.
kerberos=Kerberos
noNodesInstructions=There are no nodes registered, you can add one manually.
login=Login
eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.name=Identity provider retrieve token error
local=Local
noGroupsInThisSubGroupInstructions=You haven't created any groups in this sub group.
validatorColNames.colName=Validator name
userVerify.required=Required
searchMembers=Search members
keySizeHelp=Size for the generated keys
otpSupportedApplications.totpAppGoogleName=Google Authenticator
clientDeleteConfirmTitle=Delete client?
policyDetails=Policy details
changedUsersSyncHelp=Period for synchronization of changed or newly created LDAP users in seconds
trustEmailHelp=If enabled, email provided by this provider is not verified even if verification is enabled for the realm.
editModeKerberosHelp=READ_ONLY means that password updates are not allowed and user always authenticates with Kerberos password. UNSYNCED means that the user can change the password in the Keycloak database and this one will be used instead of the Kerberos password.
invalidateRotatedSecretExplain=After invalidating rotated secret, the rotated secret will be removed automatically
clientSessionMaxHelp=Max time before a client session is expired. Tokens are invalidated when a session is expired. The option does not affect the global user SSO session. If not set, it uses the standard SSO Session Max value.
clientScopeDetails=Client scope details
requiredHelp=Set the attribute as required. If enabled, the attribute must be set by users and administrators. Otherwise, the attribute is optional.
clientScopeRemoveError=Could not remove the scope mapping {{error}}
testConnectionHint.withEmail=When testing the connection an e-mail will be sent to the current user ({{email}}).
adminURLHelp=URL to the admin interface of the client. Set this if the client supports the adapter REST API. This REST API allows the auth server to push revocation policies and other administrative tasks. Usually this is set to the base URL of the client.
otpPolicyPeriodHelp=How many seconds should an OTP token be valid? Defaults to 30 seconds.
otpPolicyCodeReusableHelp=Possibility to use the same OTP code again after successful authentication.
parentId=Parent ID
storePasswordHelp=Password to access the archive itself
directAccess=Direct access grants
logoutServiceSoapBindingUrl=Logout Service SOAP Binding URL
userFedDeletedSuccess=The user federation provider has been deleted.
eventTypes.UNREGISTER_NODE.description=Unregister node
whoWillAppearPopoverTextRoles=This tab shows only the users who are assigned directly to this role. To see users who are assigned this role as an associated role or through a group, go to
showPassword=Show password field in clear text
logic=Logic
clientScopeSearch.type=Assigned type
scopePermissions.groups.manage-membership-description=Policies that decide if an administrator can add or remove users from this group
resourceType=Resource type
copied=Authorization details copied.
scopeName=A unique name for this scope. The name can be used to uniquely identify a scope, useful when querying for a specific scope.
userObjectClassesHelp=All values of LDAP objectClass attribute for users in LDAP, divided by commas. For example\: 'inetOrgPerson, organizationalPerson'. Newly created Keycloak users will be written to LDAP with all those object classes and existing LDAP user records are found just if they contain all those object classes.
userInfoUrlHelp=The User Info Url. This is optional.
clientProfileSearch=Search
addSavedTypes=Add saved types
setPasswordFor=Set password for {{username}}
eventTypes.CODE_TO_TOKEN.name=Code to token
updateUserLocale=Update User Locale
whoWillAppearPopoverTextUsers=Groups are hierarchical. When you select Direct Membership, you see only the child group that the user joined. Ancestor groups are not included.
mapperCreateError=Error creating mapper: {{error}}
resetBtn=Reset
mode=Mode
kc.realm.name=Realm
userFedDisableConfirmTitle=Disable user federation provider?
impersonate=Impersonate
eventTypes.CLIENT_REGISTER.name=Client register
mappingTable=Table with predefined mapping
requestObject.not\ required=Not required
adminURL=Admin URL
generatedAccessTokenNo=No generated access token
always=Always
pkceEnabledHelp=Use PKCE (Proof of Key-code exchange) for IdP Brokering
settings=Settings
webAuthnPolicyUserVerificationRequirement=User verification requirement
failureFactorHelp=Number of failures before wait is triggered.
maxSecondaryAuthFailuresHelp=Maximum number of secondary authentication failures before permanent lockout is triggered. Account will be locked even in temporary lockout brute force modes. Value of 0 means the behavior is disabled.
unlinkAccountTitle=Unlink account from {{provider}}?
noNodes=No nodes registered
singleLogoutServiceUrlHelp=The Url that must be used to send logout requests.
authorizationEncryptedResponseAlg=Authorization response encryption key management algorithm
useTruststoreSpi=Use Truststore SPI
allowEcpFlowHelp=This client is allowed to use ECP flow for authenticating users.
noSessions=No sessions
clipboardCopyError=Error copying to clipboard.
storeTokens=Store tokens
storeTokenInSession=Store token in session
usermodel.clientRoleMapping.rolePrefix.tooltip=A prefix for each client role (optional). The special token ${client_id} can be used and this will be replaced by the actual client ID. This is useful especially when you are adding roles from all the clients (Hence 'Client ID' switch is unset) and need to present the client roles as a list, prefixed with the originating client's client ID.
deleteConfirmCurrentUser=Are you sure you want to permanently delete this user?
eventTypes.CLIENT_REGISTER_ERROR.description=Client register error
addClientScopesTo=Add client scopes to {{clientName}}
x509=X.509 Subject Name
showDataBtn=Show data
dedicatedScopeDescription=Dedicated scope and mappers for this client
Sunday=Sunday
editMode=Edit mode
updatePasswordPolicySuccess=Password policies successfully updated
passwordHelp=SMTP password. This field is able to obtain its value from vault, use ${vault.ID} format.
removedGroupMembership=Removed group membership
deleteScopeWarning=The permissions below will be removed when they are no longer used by other authorization scopes\:
compositeRoleOff=Composite role turned off
fullSyncPeriod=Full sync period
clientsExplain=Clients are applications and services that can request authentication of a user.
addNode=Add node
jwksUrl=JWKS URL
jwks=JSON Web Key Set
policy-description=A description for this policy.
defaultPasswordLabel=My password
mapperUserAttributeName=User Attribute Name
importClient=Import client
deleteMapperSuccess=Mapper successfully deleted.
scopeSaveError=Could not persist authorization scope due to {{error}}
used.SPECIFIC_PROVIDERS=Specific providers
deletedSuccessIdentityProvider=Provider successfully deleted.
reload=Reload
eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING_ERROR.description=Client initiated account linking error
eventTypes.IDENTITY_PROVIDER_LOGIN_ERROR.name=Identity provider login error
scopePermissions.groups.view-description=Policies that decide if an administrator can view this group
tokens=Tokens
createFlow=Create flow
encryptAssertionsHelp=Should SAML assertions be encrypted with client's public key?
oAuthDPoPHelp=This enables support for Demonstrating Proof-of-Possession (DPoP) bound tokens. For public clients, both access and refresh tokens are bound to the key stored on the client. In order to prove the possession of the key, the client must send a signed proof alongside the token. For confidential clients, only access tokens are DPoP bound because, following the specification, refresh tokens are already sender-constrained by the associated authentication requirement.
unsavedChangesConfirm=You have unsaved changes. Do you really want to leave the page?
disabledOff=Disabled off
membershipLdapAttributeHelp=Name of LDAP attribute on group, which is used for membership mappings. Usually it will be 'member'. However when 'Membership Attribute Type' is 'UID', then 'Membership LDAP Attribute' could be typically 'memberUid'.
usersLeftError=Could not remove users from the group\: {{error}}
addTypes=Add types
pushedAuthorizationRequestRequiredHelp=Boolean parameter indicating whether the authorization server accepts authorization request data only via the pushed authorization request method.
requirement=Requirement
any=Any
minute=Minute
useJwksUrl=Use JWKS URL
wantAssertionsSigned=Want Assertions signed
roleSaveSuccess=The role has been saved
scopeParameter=Scope parameter
unsigned=Unsigned
userGroupsRetrieveStrategy=User groups retrieve strategy
addSubFlow=Add sub-flow
validatingPublicKeyHelp=The public key in PEM or JWKS format that must be used to verify external IDP signatures. When JWKS is used, it can contain multiple public keys. The button below can be used to import an external file with different key and certificate formats. The provider needs to be saved after the import to store the changes.
client-uris-must-match.label=Client URIs Must Match
webAuthnPolicyAcceptableAaguids=Acceptable AAGUIDs
noRoles-roles=No roles in this realm
logoutServiceRedirectBindingURLHelp=SAML Redirect Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.
deleteMapperConfirm=Are you sure you want to permanently delete the mapper {{mapper}}?
scopePermissions.roles.map-role-description=Policies that decide if an administrator can map this role to a user or group
backchannelUrlInvalid=Backchannel logout URL is not a valid URL
eventTypes.LOGIN.description=Login
impersonateConfirm=Impersonate user?
scopePermissions.clients.map-roles-client-scope-description=Policies that decide if an administrator can apply roles defined by this client to the client scope of another client
accessTokenSuccess=Access token regenerated
includeInIdToken.tooltip=Should the claim be added to the ID token?
validRequestURIs=Valid request URIs
allowPasswordAuthentication=Allow password authentication
federationLinkHelp=UserStorageProvider this locally stored user was imported from.
validateUsernameLDAPAttribute=You must enter a username LDAP attribute
pairwiseSubAlgorithmSalt.tooltip=Salt used when calculating the pairwise subject identifier. If left blank, a salt will be generated.
waitIncrementSecondsHelp=When the failure threshold is met, how long should the user be locked out?
allowKerberosAuthentication=Allow Kerberos authentication
addressClaim.formatted.tooltip=Name of the User Attribute to use for mapping to the 'formatted' subclaim inside the 'address' token claim. Defaults to 'formatted'.
predefinedMappingDescription=Choose any of the predefined mappings from this table
allowedClockSkew=Allowed clock skew
privateRSAKey=Private RSA Key
createPermission=Create permission
moveToGroup=Move {{group1}} to {{group2}}
noRealmRoles=No realm roles
events-disable-confirm=If "Save events" is disabled, subsequent events will not be displayed in the "Events" menu
reqAuthnConstraints=Requested AuthnContext Constraints
eventTypes.PUSHED_AUTHORIZATION_REQUEST.description=Pushed authorization request
addIdpMapperNameHelp=Name of the mapper.
requirements.ALTERNATIVE=Alternative
claimFilterValueHelp=Value of the essential claim (with regex support)
credentialResetConfirm=Send Email
permissionsEnabledHelp=Determines if fine grained permissions are enabled for managing this role. Disabling deletes all current permissions.
consentScreenTextHelp=Text that will be shown on the consent screen when this client scope is added to some client with consent required. The placeholder 0 can be used to reference the parameter if the scope is dynamic (between curly brackets). Defaults to name of client scope if it is not filled.
realmRolesList=Realm roles
roleList=Role list
kerberosRealm=Kerberos realm
scopePermissions.groups.manage-members-description=Policies that decide if an administrator can manage the members of this group
consentRequiredHelp=If enabled, users have to consent to client access.
flow.direct\ grant=Direct grant flow
eventTypes.EXECUTE_ACTION_TOKEN.name=Execute action token
groupName=Group name
eventTypes.RESTART_AUTHENTICATION.name=Restart authentication
authorizationUrl=Authorization URL
eventTypes.VALIDATE_ACCESS_TOKEN.name=Validate access token
contextualAttributes=Contextual Attributes
replyTo=Reply to
providerDescription=Provider description
downloadAdapterConfig=Download adapter config
scopePermissions.clients.view-description=Policies that decide if an administrator can view this client
allowEcpFlow=Allow ECP flow
rsa=rsa
setPasswordConfirmText=Are you sure you want to set the password for the user {{username}}?
updateErrorIdentityProvider=Could not update the provider. {{error}}
emptyProfiles=No client profiles configured
createClientProfileError=Could not create client profile\: '{{error}}'
usermodel.clientRoleMapping.clientId.tooltip=Client ID for role mappings. Just client roles of this client will be added to the token. If this is unset, client roles of all clients will be added to the token.
targetOptions.local=LOCAL
addTranslationError=Error creating translation, {{error}}
pkceMethodHelp=PKCE Method to use
encryption=Encryption
addExecutorError=Executor not created: {{error}}
scopePermissions.clients.manage-description=Policies that decide if an administrator can manage this client
vendor=Vendor
roleRemoveAssociatedText=This action will remove {{role}} from {{roleName}}. All the associated roles of {{role}} will also be removed.
disabled=Disabled
idpInitiatedSsoRelayState=IDP Initiated SSO Relay State
attribute=Attribute
clientScopesConditionTooltip=The list of expected client scopes. Condition evaluates to true if specified client request matches some of the client scopes. It depends also whether it should be default or optional client scope based on the 'Scope Type' configured.
timestamp=Created date
principalAttributeHelp=Name or Friendly Name of the attribute used to identify external users.
nameIdPolicyFormat=NameID policy format
idpInitiatedSsoUrlName=IDP-Initiated SSO URL name
selectMethod=Select method
deleteConfirmExecution=Delete flow {{name}}?
eventTypes.VALIDATE_ACCESS_TOKEN_ERROR.name=Validate access token error
xFrameOptions=X-Frame-Options
scopeDescriptionHelp=Description of the client scope
deletedErrorRealmSetting=Could not delete realm\: {{error}}
copyInitialAccessToken=Please copy and paste the initial access token before closing as it can not be retrieved later.
consensus=Consensus
scopePermissions.roles.map-role-composite-description=Policies that decide if an administrator can apply this role as a composite to another role
emptyEvents=Nothing to add
residentKey.Yes=Yes
eventTypes.SEND_IDENTITY_PROVIDER_LINK.name=Send identity provider link
ssoSessionIdleRememberMe=Time a remember me session is allowed to be idle before it expires. Tokens and browser sessions are invalidated when a session is expired. If not set it uses the standard SSO Session Idle value.
SSOSessionIdleRememberMe=SSO Session Idle Remember Me
cibaBackchannelTokenDeliveryModeHelp=Specifies how the CD (Consumption Device) gets the authentication result and related tokens. This mode will be used by default for the CIBA clients, which do not have other mode explicitly set.
eventTypes.REGISTER_NODE.description=Register node
supported=Supported
deprecated=Deprecated
deleteAttributeText=Delete an attribute
deleteNodeSuccess=Node successfully removed
includeInIntrospection.label=Add to token introspection
roleImportSuccess=Role import successful
tokenUrl=Token URL
executionConfig={{name}} config
grantedClientScopes=Granted client scopes
keyError=A key must be provided.
invitations=Invitations
invitationsList=Invitations list
searchInvitations=Search invitations
filterByStatus=Filter by status
sentDate=Sent date
expiresAt=Expires at
resendInvitation=Resend invitation
copyInviteLink=Copy invite link
inviteLinkCopied=Invite link copied to clipboard
deleteInvitation=Delete invitation
deleteInvitations=Delete invitations
organizationInvitationsDeleteConfirmTitle=Delete invitations?
organizationInvitationsDeleteConfirm=Are you sure you want to delete the selected invitations?
organizationInvitationResent=Invitation resent successfully
organizationInvitationResendError=Could not resend invitation\: {{error}}
organizationInvitationsDeleted_one=Invitation deleted successfully
organizationInvitationsDeleted_other={{count}} invitations deleted successfully
organizationInvitationsDeleteError=Could not delete invitations\: {{error}}
organizationsInvitationsListError=Could not load invitations\: {{error}}
emptyInvitations=No invitations
emptyInvitationsInstructions=There are no invitations yet. Send an invitation first.
organizationInvitationStatus.pending=Pending
organizationInvitationStatus.expired=Expired
addAnnotationText=Add annotation
helpToggleInfo=This toggle will enable / disable part of the help info in the UI. Includes any help text, links and popovers.
clientProfileName=Client profile name
effectiveProtocolMappers=Effective protocol mappers
userVerify.preferred=Preferred
syncModes.legacy=Legacy
allowRegexComparisonHelp=If OFF, then the Subject DN from given client certificate must exactly match the given DN from the 'Subject DN' property as described in the RFC8705 specification. The Subject DN can be in the RFC4514 or RFC1779 format. If ON, then the Subject DN from given client certificate should match regex specified by 'Subject DN' property. This option is deprectated, in the future only exact DN comparison will be allowed.
eventTypes.UPDATE_TOTP_ERROR.description=Update totp error
titleEvents=Events
signServiceProviderMetadata=Sign service provider metadata
updateClientPoliciesError=Could not update client policies\: {{error}}
acceptsPromptNoneHelp=This is used only together with the Identity Provider Authenticator or when kc_idp_hint points to this identity provider. If that client sends a request with prompt\=none and the user is not authenticated, the error is not directly returned to the client; the request with prompt\=none is forwarded to this identity provider.
requiresShortStateParameterHelp=This switch needs to be enabled if identity provider does not support long value of the 'state' parameter sent in the initial OIDC/OAuth2 authentication request (EG. more than 100 characters). In this case, Keycloak will try to make shorter 'state' parameter and may omit some client data to be sent in the initial request. This may result in the limited functionality in some very corner case scenarios (EG. in case that IDP redirects to Keycloak with the error in the OIDC authentication response, Keycloak might need to display error page instead of being able to redirect to the client in case that login session is expired).
roleDetails=Role details
eventTypes.USER_INFO_REQUEST.name=User info request
clientScopeType.none=None
results=Results
userRolesRetrieveStrategyHelp=Specify how to retrieve roles of user. LOAD_ROLES_BY_MEMBER_ATTRIBUTE means that roles fo user will be retrieved by sending LDAP query to retrieve all roles where 'member' is our user. GET_ROLES_FROM_USER_MEMBEROF means that roles of user will be retrieved from 'memberOf' attribute of our user. Or from the other attributes specified by 'Member-Of LDAP Attribute'. LOAD_ROLES_BY_MEMBER_ATTRIBUTE is applicable just in Active Directory and it means that roles of user will be retrieved recursively with usage of LDAP_MATCHING_RULE_IN_CHAIN LDAP extension.
roleDeleteError=Could not delete role\: {{error}}
selectScope=Select a scope
attributeDefaultValue=Attribute default value
eventTypes.UPDATE_PASSWORD_ERROR.name=Update password error
addGroups=Add groups
offlineSessionIdle=Offline Session Idle
mapperAttributeFriendlyName=Friendly name
addProvider=Add provider
readOnlyHelp=Read-only attribute that is imported from LDAP to UserModel but is not saved back to LDAP when the user is updated in Keycloak.
resourceDeletedError=Could not remove the resource {{error}}
backchannelLogoutUrl=Backchannel logout URL
requestObjectEncodingHelp=JWE algorithm, which the client needs to use when encrypting the content of the OIDC request object specified by the 'request' or 'request_uri' parameters. If set to 'any', any algorithm is allowed.
minimumQuickLoginWaitSeconds=Minimum quick login wait
duplicate=Duplicate
roleDeleteConfirm=Delete role?
createClientProfileNameHelperText=The name must be unique within the realm
disabledHelp=A disabled user cannot log in.
eventTypes.UPDATE_PROFILE_ERROR.name=Update profile error
adminThemeHelp=Select a theme for administration console.
name=Name
deleteConfirmDialog_other=Are you sure you want to permanently delete {{count}} selected users
targetOptions.brokerUsername=BROKER_USERNAME
clientList=Clients
eventTypes.REGISTER_ERROR.description=Register error
infoDisabledFeatures=Shows all disabled features.
userSession.modelNote.label=User Session Note
next=Next
previous=Previous
userLabel=User label
pagination=Pagination
changeAuthenticatorConfirm=If you change authenticator to {{clientAuthenticatorType}}, the Keycloak database will be updated and you may need to download a new adapter configuration for this client.
import=Import
otpHashAlgorithm=OTP hash algorithm
importFail=Import failed\: {{error}}
show=Show
description=Description
alwaysReadValueFromLdap=Always read value from LDAP
searchUserEventsBtn=Search events
addressClaim.postal_code.tooltip=Name of User Attribute, which will be used to map to the 'postal_code' subclaim inside the 'address' token claim. Defaults to 'postal_code'.
generatedUserInfoNo=No generated user info
allowed-client-scopes.label=Allowed Client Scopes
providerId=Provider ID
assignedClientScope=Assigned client scope
savePasswordSuccess=The password has been set successfully.
Tuesday=Tuesday
idTokenEncryptionContentEncryptionAlgorithm=ID token encryption content encryption algorithm
idTokenAsDetachedSignature=Use ID Token as a Detached Signature
newRoleName=New role name
listExplain=Identity providers are social networks or identity brokers that allow users to authenticate to Keycloak.
emptyInstructions=Change your search criteria or add a user
tableView=Table view
addClientProfile=Add client profile
maxFailureWaitSeconds=Max wait
userEventsRegistered=User events registered
editGroup=Edit group
eventConfigError=Could not save event configuration\: {{error}}
confirmAccessTokenTitle=Regenerate registration access token?
target=Target
impersonateConfirmDialog=Are you sure you want to log in as this user? If this user is in the same realm with you, your current login session will be logged out before you log in as this user.
alwaysDisplayInUI=Always display in UI
protocolMapper=Protocol...
requiredSettings=Required Settings
oneLevel=One Level
userSaved=The user has been saved
useRefreshTokens=Use refresh tokens
standardFlowHelp=This enables standard OpenID Connect redirect based authentication with authorization code. In terms of OpenID Connect or OAuth2 specifications, this enables support of 'Authorization Code Flow' for this client.
clientDeleteConfirm=If you delete this client, all associated data will be removed.
derFormattedHelp=Activate this if the certificate is DER formatted in LDAP and not PEM formatted.
eventTypes.IDENTITY_PROVIDER_POST_LOGIN.name=Identity provider post login
scopePermissions.users.view-description=Policies that decide if an administrator can view all users in realm
ldapGeneralOptionsSettingsDescription=This section contains a few basic options common to all user storage providers.
importSkipped_one=One record skipped.
eventTypes.OAUTH2_DEVICE_AUTH.description=OAuth2 device authentication
notBeforeClearedSuccess=Success\! "Not Before" cleared for realm.
policySaveError=Could not update the policy: {{error}}
experimental=Experimental
idTokenSignatureAlgorithmHelp=JWA algorithm used for signing ID tokens.
deleteResourceConfirm=If you delete this resource, some permissions will be affected.
httpPostBindingResponse=HTTP-POST binding response
artifactBindingResponse=ARTIFACT binding response
tokenLifespan.inherited=Inherits from realm settings
saveEvents=Save events
issuer=Issuer
policyEnforcementModeHelp=The policy enforcement mode dictates how policies are enforced when evaluating authorization requests. 'Enforcing' means requests are denied by default even when there is no policy associated with a given resource. 'Permissive' means requests are allowed even when there is no policy associated with a given resource. 'Disabled' completely disables the evaluation of policies and allows access to any resource.
selectAUser=Select a user
groupCreated=Group created
generateError=Could not generate a new key pair and certificate {{error}}
getKeyInfoError=Could not read the certificate information {{error}}
testClusterSuccess=Successfully verified availability for\: {{successNodes}}
whoWillAppearLinkTextRoles=Who will appear in this user list?
attestationPreference.not\ specified=Not specified
importConfigHelp=Import metadata from a downloaded IDP discovery descriptor.
targetClaim=Target claim
assignRole=Assign role
accessSettings=Access settings
updateFlowSuccess=Flow successfully updated
authenticatedAccessPolicies=Authenticated access polices
addExecutor=Add executor
selectIfResourceExists=If a resource already exists, specify what should be done
passwordPoliciesHelp.notEmail=The password cannot match the email address of the user.
deleteAttributeGroupError=Could not delete user attributes group\: {{error}}
trustEmail=Trust Email
credentialReset=Credentials Reset
eventTypes.CUSTOM_REQUIRED_ACTION_ERROR.name=Custom required action error
deleteValidatorConfirmTitle=Delete validator?
claimJsonType=JSON type that should be used to populate the JSON claim in the token. Valid values are long, int, boolean, String, and JSON.
kc.client.network.ip_address=Client IPv4 Address
signatureAndEncryption=Signature and Encryption
reset=Reset
hardcodedUserSessionAttribute=When a user is imported from a provider, hardcode a value to a specific user session attribute.
conditionType=Condition type
multiValued=Indicates if this attribute supports multiple values. If true, the list of all values of this attribute are set as claim. If false, only the first value is set as claim.
browse=Browse
duplicateEmailsHelpText=Allow multiple users to have the same email address. Changing this setting will also clear the user's cache. It is recommended to manually update email constraints of existing users in the database after switching off support for duplicate email addresses.
importOverwritten_zero=No records overwritten.
usermodel.realmRoleMapping.rolePrefix.label=Realm Role prefix
eventTypes.GRANT_CONSENT.name=Grant consent
noProvidersLinked=No identity providers linked.
testConnectionSuccess=Success\! SMTP connection successful. E-mail was sent\!
samlSettings=SAML settings
userFedDisableConfirm=If you disable this user federation provider, it will not be considered for queries and imported users will be disabled and read-only until the provider is enabled again.
userSessionAttribute=User Session Attribute
enabled=Enabled
forgotPassword=Forgot password
searchUserByAttributeMissingValueError=Specify a attribute value
passwordPoliciesHelp.maxLength=The maximum number of characters allowed in the password.
passwordPoliciesHelp.maxAuthAge=The maximum age of an authentication with which a password may be changed without re-authentication.
moveGroupError=Could not move group: {{error}}
clientImportSuccess=Client imported successfully
dragHelp=Press space or enter to begin dragging, and use the arrow keys to navigate up or down. Press enter to confirm the drag, or any other key to cancel the drag operation.
startTime=Start time
logicHelp=The logic dictates how the policy decision should be made. If 'Positive', the resulting effect (permit or deny) obtained during the evaluation of this policy will be used to perform a decision. If 'Negative', the resulting effect will be negated, in other words, a permit becomes a deny and vice-versa.
allowRegexComparison=Allow regex pattern comparison
noSessionsForUser=There are currently no active sessions for this user.
eventTypes.IDENTITY_PROVIDER_LINK_ACCOUNT_ERROR.description=Identity provider link account error
implicitFlowHelp=This enables support for OpenID Connect redirect based authentication without authorization code. In terms of OpenID Connect or OAuth2 specifications, this enables support of 'Implicit Flow' for this client.
user-events-cleared-error=Could not clear the user events {{error}}
eventTypes.IMPERSONATE_ERROR.name=Impersonate error
executorType=Executor type
configureMappingDescription=Choose any of the mappings from this table
keystorePassword=Keystore password
more={{count}} more
clientNameHelp=Specifies display name of the client. For example 'My Client'. Supports keys for localized values as well. For example\: ${my_client}.
mappersList=Mappers list
rootUrl=Root URL
realmExplain=A realm manages a set of users, credentials, roles, and groups. A user belongs to and logs into a realm. Realms are isolated from one another and can only manage and authenticate the users that they control.
inputHelperTextBefore=Helper text (above) the input field
webAuthnPolicyExtraOrigins=Extra Origins
passkeys=Passkeys
webAuthnPolicyPasskeysEnabled=Enable Passkeys
webAuthnPolicyPasswordlessPasskeysEnabled=Enable Passkeys
passkeysSettingsTooltip=Go to WebAuthn Passwordless Policy to configure Passkeys settings
webAuthnPolicyMediation=Passkey Mediation
mediation.conditional=Conditional (autofill only)
mediation.none=None (button only, no automatic prompt)
mediation.optional=Optional (show dialog on page load)
mediation.required=Required (force immediate dialog)
mediation.silent=Silent (no user interaction)
samlSignatureKeyName=SAML signature key name
validateUsersDn=You must enter users DN
importError=Could not import certificate {{error}}
logicType.negative=Negative
otpPolicy=OTP Policy
noRolesInstructions-groups=You haven't created any roles for this group. Create a role to get started.
cibaBackchannelTokenDeliveryMode=Backchannel Token Delivery Mode
validateAttributeName=Attribute configuration without a name is not allowed.
eventTypes.RESET_PASSWORD_ERROR.description=Reset password error
addUser=Add user
eventTypes.REGISTER.description=Register
includeAuthnStatementHelp=Should a statement specifying the method and timestamp be included in login responses?
evaluateError=Could not evaluate due to\: {{error}}
iconUriHelp=A URI pointing to an icon.
eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.name=OAuth2 device verify user code
protocol=Protocol
permissionsScopeName=Scope-name
validPostLogoutRedirectURIsHelp=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' or an empty field uses the list of valid redirect URIs. A value of '-' does not allow any post logout redirect URIs. Simple wildcards are allowed such as 'http\://example.com/*'. A relative path can be specified too, such as /my/relative/path/*. Relative paths are relative to the client root URL; if none is specified, the auth server root URL is used.
manageAccount=Manage account
oauthDeviceAuthorizationGrant=OAuth 2.0 Device Authorization Grant
copyFlowError=Could not duplicate flow\: {{error}}
roleRemoveAssociatedRoleConfirm=Remove associated role?
httpPostBindingAuthnRequest=HTTP-POST binding for AuthnRequest
includeInAccessToken.label=Add to access token
samlKeysExportSuccess=Successfully exported keys
usersInRole=Users in role
policyProvider.group=Define conditions for your permissions where a set of one or more groups (and their hierarchies) is permitted to access an object.
updatedUserProfileError=User Profile configuration hasn't been saved: {{error}}
emptyPermissions=No permissions
deletePermission=Permanently delete permission?
selectUser=Select a user whose identity is going to be used to query permissions from the server.
resultPermit=Result-Permit
userFederationExplain=User federation provides access to external databases and directories, such as LDAP and Active Directory.
emptyAuthorizationScopes=No authorization scopes
noDefaultGroups=No default groups
policyProvider.time=Define time conditions for your permissions.
updateFlowError=Could not update flow\: {{error}}
valuePlaceholder=Type a value
usersLeft_other={{count}} users left the group
updateClientContext=Update Client Context
removeAssociatedRoles=Remove associated roles
nameIdPolicyFormatHelp=Specifies the URI reference corresponding to a name identifier format.
mappers=Mappers
attributeGeneralSettingsDescription=This section contains a few basic settings common to all attributes.
name-id-format=Name ID Format
deleteRealm=Delete realm
noRoles-clientScopes=No roles for this client scope
noRoles-clients=No roles for this client scope
deleteFlowError=Could not delete flow\: {{error}}
eventTypes.IDENTITY_PROVIDER_POST_LOGIN.description=Identity provider post login
roleImportError=Could not import role
regexAttributeValuesHelp=If enabled, attribute values are interpreted as regular expressions.
userCreated=The user has been created
residentKey.not\ specified=Not specified
alwaysReadValueFromLdapHelp=If on, then during reading of the LDAP attribute value will always be used instead of the value from Keycloak database.
usermodel.clientRoleMapping.tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and to use the dot literally, escape the dot with a backslash (\\.). You can use the special token ${client_id}; it will be replaced by the actual client ID. An example usage is 'resource_access.${client_id}.roles'. This option is especially useful when you add roles from all the clients, meaning 'Client ID' is disabled, and you want client roles of each client stored separately.
scopePermissions.clients.map-roles-description=Policies that decide if an administrator can map roles defined by this client
signAssertions=Sign assertions
disableUserInfoHelp=Disable usage of User Info service to obtain additional user information? Default is to use this OIDC service.
xFrameOptionsHelp=Default value prevents pages from being included by non-origin iframes. <formattedlink>Learn more</formattedlink>
copyError=Error copying authorization details\: {{error}}
validateSignatures=Enable/disable signature validation of SAML responses.
authentication=Authentication
eventTypes.DELETE_ACCOUNT.name=Delete account
logoutUrlHelp=End session endpoint to use to log out the user from the external IDP.
noUserDetails=No user details
sync-ldap-groups-to-keycloak=Sync LDAP groups to Keycloak
attestationPreference.indirect=Indirect
frontchannelUrlInvalid=Front-channel logout URL is not a valid URL
noCredentialsText=This user does not have any credentials. You can set password for this user.
deletePolicyWarning=The aggregated polices below will be removed automatically\:
validatingPublicKey=Validating public key
permissionsListIntro=Edit the permission list by clicking the scope-name. It then redirects to the permission details page of the client named <1>{{realm}}</1>
deleteClientConditionSuccess=Condition deleted successfully.
signatureAlgorithm=Signature algorithm
deleteConfirmIdentityProvider=Are you sure you want to permanently delete the provider '{{provider}}'?
resetActions=Reset Actions
cibaExpiresInHelp=The expiration time of the "auth_req_id" in seconds since the authentication request was received.
eventTypes.CLIENT_INFO_ERROR.description=Client info error
batchSize=Batch size
user=User
scopesAsRequested=Scopes are requested
updateErrorClientScope=Could not update client scope\: '{{error}}'
eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE.description=OAuth2 device verify user code
useKerberosForPasswordAuthentication=Use Kerberos for password authentication
validateUuidLDAPAttribute=You must enter a UUID LDAP attribute
client-scopes-condition.tooltip=The list of expected client scopes. Condition evaluates to true if specified client request matches some of the client scopes. It depends also whether it should be default or optional client scope based on the 'Scope Type' configured.
rootURLHelp=Root URL appended to relative URLs
anonymousAccessPolicies=Anonymous access polices
createResourceBasedPermission=Create resource-based permission
searchForRole=Search role
debugHelp=Enable/disable debug logging to standard output for Krb5LoginModule.
validatorColNames.colConfig=Config
createClient=Create client
inputTypeRows=Input rows
eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN.description=Identity provider first login
usedMemory=Used memory
validatePasswordPolicyHelp=Determines if Keycloak should validate the password with the realm password policy before updating it. When the user's password is saved in LDAP, some Keycloak password policies do not work: Not Recently Used, Expire Password, Hashing Iterations, and Hashing Algorithm. This situation occurs because Keycloak does not have direct control over the password storage. if you want to use those policies, enable password policies at the LDAP server layer.
bruteForceModeHelpText=If enabled, specify what should happen to the user account if a brute force attack is detected.
quickLoginCheckMilliSeconds=Quick login check milliseconds
createResourceSuccess=Resource created successfully
documentation=Documentation
fullNameLdapReadOnlyHelp=For Read-only, data is imported from LDAP to the Keycloak database, but it is not saved back to LDAP when the user is updated in Keycloak.
roleExplain=Realm roles are the roles that you define for use in the current realm.
whatIsDefaultGroups=What is the function of default groups?
transient=Transient
generalSettings=General settings
addClientProfileError=Could not create client profile\: '{{error}}'
overallResults=Overall Results
requiredUserActionsHelp=Require an action when the user logs in. 'Verify email' sends an email to the user to verify that user's email address. 'Update profile' requires the user to enter new personal information. 'Update password' requires the user to enter a new password. 'Configure OTP' requires setup of a mobile password generator.
requestObjectSignatureAlgorithmHelp=JWA algorithm, which the client needs to use when sending an OIDC request object specified by the 'request' or 'request_uri' parameters. If set to 'any', the Request object can be signed by any algorithm (including 'none').
ldapKerberosSettingsDescription=This section contains options useful for the Kerberos integration. This is used only when the LDAP server is used together with Kerberos/SPNEGO for user authentication.
deleteEvents=Clear events
termsOfServiceUrlHelp=URL that the Relying Party Client provides to the End-User to read about the Relying Party's terms of service
clientSecretError=Could not regenerate client secret due to\: {{error}}
resourcePath=Resource path
useJwksUrlHelp=If the switch is ON, identity provider public keys are downloaded from a given JWKS URL. The result is great flexibility because new keys are downloaded again when the identity provider generates a new keypair. If the switch is OFF, a public key (or certificate) from the Keycloak database is used; therefore, when the identity provider keypair changes, you again need to import the new key to the Keycloak database.
downloadAdaptorTitle=Download adaptor configs
client-roles.label=Client Roles
keysFilter.PASSIVE=Passive keys
revocation=Revocation
scopeTypeHelp=Determines how the client scope is assigned to new clients. Default scopes are automatically included in token requests. Optional scopes are only included when explicitly requested. None means the scope must be manually added to each client.
search=Search
validateEditMode=You must select an edit mode
copyFlowSuccess=Flow successfully duplicated
cacheSettings=Cache settings
client-attributes.label=Client Attributes
searchForClient=Search for client
permissionDeletedError=Could not delete permission due to {{error}}
eventTypes.UPDATE_PROFILE.name=Update profile
realmId=Realm ID
eventTypes.PERMISSION_TOKEN_ERROR.description=Permission token error
algorithmHelp=Intended algorithm for the key
importFile=Import file
userVerify.discouraged=Discouraged
ldapRolesDn=LDAP roles DN
displayOnClientHelp=Applicable only if 'Consent Required' is on for this client. If this switch is off, the consent screen will contain just the consents corresponding to configured client scopes. If on, there will be also one item on the consent screen about this client itself.
requestObjectRequired=Request object required
protocolHelp=SSO protocol configuration supplied by this client scope
prompts.none=None
resourcesHelp=Specifies that this permission must be applied to a specific resource instance.
passwordConfirmation=Password confirmation
aggregate.attrs.tooltip=Indicates if attribute values should be aggregated with the group attributes. If using OpenID Connect mapper the multivalued option needs to be enabled too in order to get all the values. Duplicated values are discarded and the order of values is not guaranteed with this option.
helpLabel=More help for '{{label}}'
noRoles=No roles for this user
createAttribute=Create attribute
Thursday=Thursday
importOverwritten_one=One record overwritten.
tokenDeleteError=Could not delete initial access token\: '{{error}}'
eventTypes.REGISTER_NODE_ERROR.name=Register node error
isMandatoryInLdap=Is mandatory in LDAP
discoveryEndpoint=Discovery endpoint
claimValue=Claim Value
eventTypes.FEDERATED_IDENTITY_LINK.name=Federated identity link
authenticationHelp=This switch defines the type of OIDC client. When it is ON, the type is confidential access. When it is OFF, the type is public access.
deleteClientConditionError=Error creating condition\: {{error}}
noMappers=No Mappers
couldNotLinkIdP=Could not link identity provider {{error}}
otpPolicyPeriod=OTP Token period
managePriorities=Manage priorities
createClientPolicySuccess=New policy created
realmDisplayNameHelp=Display name of the realm. Supports the $\{key\} syntax to reference a localization key from the realm's message bundle.
frontendUrlHelp=Set the frontend URL for the realm. Use in combination with the default hostname provider to override the base URL for frontend requests for a specific realm.
used.notInUse=Not in use
emailSettings=Email settings
samlEntityDescriptorHelp=Allows you to load external IDP metadata from a config file or to download it from a URL.
generatedIdTokenHelp=See the example ID Token, which will be generated and sent to the client when the selected user is authenticated. You can see claims and roles that the token will contain based on the effective protocol mappers and role scope mappings and also based on the claims and roles assigned to the actual user.
createClientProfile=Create client profile
passwordPoliciesHelp.specialChars=The number of special characters required in the password string.
cachePolicy=Cache policy
noCredentials=No credentials
clientOfflineSessionIdle=Client Offline Session Idle
eventListeners=Event listeners
bindDn=Bind DN
evictionHourHelp=Hour of the day the entry will become invalid
permissionDetails=Permission details
clipboardCopyDenied=Your browser is blocking access to the clipboard.
Friday=Friday
saveProviderListSuccess=The priority of the provider has been updated successfully.
copyToClipboard=Copy to clipboard
wantAuthnRequestsSigned=Want AuthnRequests signed
usermodel.attr.tooltip=Name of stored user attribute which is the name of an attribute within the UserModel.attribute map.
clientPoliciesProfiles=Client Policies Profiles
eventTypes.SEND_VERIFY_EMAIL.name=Send verify email
requiredForLabel.both=Both users and admins
eventTypes.REGISTER_NODE.name=Register node
addToFilter=Add to filter
CONFIGURE_TOTP=Configure OTP (CONFIGURE_TOTP)
eventTypes.EXECUTE_ACTIONS.description=Execute actions
userModelAttributeName=User model attribute name
importResourceError=Could not import the resource due to {{error}}
parameterizedScope=Parameterized scope
validateName=You must enter a name
flowDetails=Flow details
never=Never
includeInIntrospection.tooltip=Should the claim be added to the token introspection?
addressClaim.region.tooltip=Name of User Attribute, which will be used to map to 'region' subclaim inside 'address' token claim. Defaults to 'region'.
IDK-periodicChangedUsersSyncHelp=Should newly created users be created within LDAP store? Priority affects which provider is chosen to sync the new user.
logoutServiceArtifactBindingUrlHelp=SAML ARTIFACT Binding URL for the client's single logout service. You can leave this blank if you are using a different binding.
claimToRole=If a claim exists, grant the user the specified realm or client role.
logoutServicePostBindingURL=Logout Service POST Binding URL
eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.name=Remove federated identity error
assertionConsumerServicePostBindingURLHelp=SAML POST Binding URL for the client's assertion consumer service (login responses). You can leave this blank if you do not have a URL for this binding.
createAuthorizationScope=Create authorization scope
noGroups=No groups
backchannelLogoutRevokeOfflineSessionsHelp=Specifying whether a "revoke_offline_access" event is included in the Logout Token when the Backchannel Logout URL is used. Keycloak will revoke offline sessions when receiving a Logout Token with this event.
roleID=Role ID
roleNameLdapAttributeHelp=Name of LDAP attribute, which is used in role objects for name and RDN of role. Usually it will be 'cn'. In this case typical group/role object may have DN like 'cn\=role1,ou\=finance,dc\=example,dc\=org'.
origin=Origin
regexPattern=Regex pattern
targetContextAttributes=Target Context Attributes
targetContextAttributesHelp=Defines the evaluation of context attributes (claims) instead of identity attributes
filteredByClaim=Verify essential claim
rowCancelBtnAriaLabel=Cancel edits for {{messageBundle}}
validateSignatureHelp=Enable/disable signature validation of external IDP tokens. When enabled, Keycloak will validate JWT tokens retrieved from the Identity provider during scenarios related to user authentication, for example when Keycloak obtains IDToken or accessToken after completion of the OIDC/OAuth2 flow with Identity provider.
searchForFlow=Search for flow
verifyEmail=Verify email
addressClaim.locality.label=User Attribute Name for Locality
formatOption=Format option
addAuthnContextClassRef=Add AuthnContext ClassRef
showPasswordDataName=Name
clientScopeTypes.none=None
whoCanEdit=Who can edit?
mappingCreatedSuccess=Mapping successfully created
eventTypes.GRANT_CONSENT.description=Grant consent
client=Client
eventTypes.OAUTH2_DEVICE_AUTH_ERROR.name=OAuth2 device authentication error
addSubFlowHelp=Sub-Flows can be either generic or form. The form type is used to construct a sub-flow that generates a single flow for the user. Sub-flows are a special type of execution that evaluate as successful depending on how the executions they contain evaluate.
implicitFlow=Implicit flow
authorizationSignedResponseAlgHelp=JWA algorithm used for signing authorization response tokens when the response mode is jwt.
associatedRolesRemoved=Associated roles have been removed
keyAliasHelp=Alias for the private key
whoWillAppearLinkTextUsers=Who will appear in this group list?
tokenClaimName.tooltip=Name of the claim to insert into the token. This can be a fully qualified name such as 'address.street'. In this case, a nested JSON object is created. To prevent nesting and use dot literally, escape the dot with a backslash (\\.).
userName=Username
clientProfileDescription=Description
ellipticCurveHelp=Elliptic curve used in ECDSA
fromPredefinedMapper=From predefined mappers
attributesGroup=Attributes Group
ssoSessionMax=Max time before a session is expired. Tokens and browser sessions are invalidated when a session is expired.
clientDeleteError=Could not delete client\: {{error}}
optimizeLookup=Optimize REDIRECT signing key lookup
joinGroupsFor=Join groups for user {{username}}
temporaryLocked=Temporarily locked
setup=Setup
unlinkAccount=Unlink account
executors=Executors
eventTypes.CLIENT_UPDATE_ERROR.name=Client update error
realm=Realm
attributeConsumingServiceIndex=Attribute Consuming Service Index
prompt=Prompt
assign=Assign
disableConfirmRealm=Users and clients cannot access the realm if it is disabled. Are you sure you want to continue?
showAuthData=Show authorization data
includeInUserInfo.tooltip=Should the claim be added to the userinfo?
select=Select
signature-algorithm=JWA algorithm, which the client needs to use when signing a JWT for authentication. If left blank, the client is allowed to use any appropriate algorithm for the particular client authenticator.
advanced=Advanced
initialCounter=Initial counter
revokeRefreshTokenHelp=If enabled, a refresh token can only be used up to 'Refresh Token Max Reuse' and it is revoked when a different token is used. Otherwise, refresh tokens are not revoked when used and can be used multiple times.
nameField=Name
ownerManagedAccessHelp=If enabled, access to this resource can be managed by the resource owner.
useLowerCaseBearerTypeHelp=If this is on, token responses will be set the with the type "bearer" in lower-case. By default, the server sets the type as "Bearer" as defined by RFC6750.
useRfc9068AccessTokenTypeHelp=If enabled, access tokens will get header type "at+jwt" in compliance with RFC9068. Otherwise, the header type will be "JWT".
addCondition=Add condition
updateSuccessClientScope=Client scope updated
connectionAndAuthentication=Connection & Authentication
clientScopeType.optional=Optional
permissionsDisableConfirm=If you disable the permissions, all the permissions in the list below will be delete automatically. In addition, the resources and scopes that are related will be removed
eventTypes.REFRESH_TOKEN.description=Refresh token
authorization=Authorization
clientProfilesHelpItem=Client profiles help item
userSessionAttributeValue=User Session Attribute Value
dayMonthHelp=Defines the day of month when the policy MUST be granted. You can also provide a range by filling the second field. In this case, permission is granted only if current day of month is between or equal to the two values you provided.
fullNameLdapWriteOnlyHelp=For Write-only, data is propagated to LDAP when a user is created or updated in Keycloak. But this mapper is not used to propagate data from LDAP back into Keycloak. This setting is useful if you configured separate firstName and lastName attribute mappers and you want to use those to read the attribute from LDAP into Keycloak.
userFedDeleteError=Could not delete user federation provider\: '{{error}}'
id=ID
join=Join
idTokenEncryptionContentEncryptionAlgorithmHelp=JWA Algorithm used for content encryption in encrypting ID tokens. This option is needed just if you want encrypted ID tokens. If left empty, ID Tokens are just signed, but not encrypted.
idTokenAsDetachedSignatureHelp=This makes ID token returned from Authorization Endpoint in OIDC Hybrid flow use as a detached signature defined in FAPI 1.0 Advanced Security Profile. Therefore, this ID token does not include an authenticated user's information.
messageBundleDescription=You can only edit the supported locales. If you haven't selected supported locales yet, you can only edit the English locale.
saveEventListenersError=Error saving event listener\: {{error}}
scopesHelp=The scopes to be sent when asking for authorization. It can be a space-separated list of scopes. Defaults to 'openid'.
multivalued.tooltip=Indicates if attribute supports multiple values. If true, the list of all values of this attribute will be set as claim. If false, just first value will be set as claim
inputOptionLabelsI18nPrefix=Internationalization key prefix
enabledHelp=Set if the keys are enabled
nameHintHelp=A unique name for the group. This name will be used to reference the group when binding an attribute to a group.
admin-events-cleared-error=Could not clear the admin events {{error}}
usersPermissionsHint=Fine grained permissions for managing all users in realm. You can define different policies for who is allowed to manage users in the realm.
isBinaryAttribute=Is binary attribute
clientScopeList=Client scopes
noValidMetaDataFound=No valid metadata was found at this URL\: '{{error}}'
eventTypes.IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR.description=Identity provider retrieve token error
usernameLdapAttribute=Username LDAP attribute
updateResourceSuccess=Resource successfully updated
displayNameHelp=Friendly name for Identity Providers.
idpAccountEmailVerification=IdP account email verification
template=Template
deleteExecutionSuccess=Execution successfully deleted
deleteConfirmTitle_other=Delete groups?
profilesConfigTypes.jsonEditor=JSON editor
testingConnection=Testing connection
noUsersFoundError=No users found due to {{error}}
executorDetails=Executor details
maxDeltaTimeSeconds=Failure reset time
backchannelLogoutHelp=Does the external IDP support backchannel logout?
eventTypes.REMOVE_FEDERATED_IDENTITY_ERROR.description=Remove federated identity error
usermodel.realmRoleMapping.rolePrefix.tooltip=A prefix which will be prepended to each Realm Role name (optional).
exportSamlKeyTitle=Export SAML Keys
eventTypes.OAUTH2_DEVICE_VERIFY_USER_CODE_ERROR.description=OAuth2 device verify user code error
eventTypes.EXECUTE_ACTIONS_ERROR.description=Execute actions error
SKIP=Skip
eventTypes.INTROSPECT_TOKEN.description=Introspect token
infoEnabledFeatures=Shows all enabled features.
displayOrderHelp=Number defining the order of the providers in GUI (for example, on the Login page). The lowest number will be applied first.
deleteCredentialsConfirm=Are you sure you want to delete these users credentials?
keysIntro=If "Use JWKS URL switch" is on, you need to fill a valid JWKS URL. After saving, admin can download keys from the JWKS URL or keys will be downloaded automatically by Keycloak server when an unknown KID is seen during client authentication.
logoutServiceArtifactBindingUrl=Logout Service ARTIFACT Binding URL
passwordPoliciesHelp.lowerCase=The number of lowercase letters required in the password string.
searchForProvider=Search for provider
ldapSearchingAndUpdatingSettingsDescription=This section contains options related to searching the LDAP server for the available users.
sessionsType.regularSSO=Regular SSO
allowed-client-scopes.tooltip=List of the allowed client scopes, which can be used on a newly registered client. Attempt to register client with some client scope, which is not allowed, will be rejected. By default, the list is either empty or contains just realm default client scopes (based on 'Allow Default Scopes' configuration property)
maxDeltaTimeSecondsHelp=When will failure count be reset?
executorsHelpItem=Executors help item
contentSecurityPolicy=Content-Security-Policy
client-uris-must-match.tooltip=If on, all Client URIs (Redirect URIs and others) are allowed just if they match some trusted host or domain.
off=Off
frontchannelLogoutHelp=When true, logout requires a browser redirect to client. When false, server performs a background invocation for logout.
frontchannelLogoutOIDCHelp=When true, logout requires a browser to send the request to the client to configured Front-channel logout URL as specified in the OIDC Front-channel logout specification. When false, server can perform a background invocation for logout as long as either the Backchannel-logout URL is configured or Admin URL is configured.
updateSuccess=Provider successfully updated
hide=Hide
isMandatoryInLdapHelp=If true, this attribute is mandatory in LDAP. If no value exists in the Keycloak database, the empty value is propagated to LDAP.
client-accesstype.label=Client Access Type
eventTypes.IDENTITY_PROVIDER_POST_LOGIN_ERROR.description=Identity provider post login error
skipCustomizationAndFinish=Skip customization and finish
mappingDeletedSuccess=Mapping successfully deleted
addIdentityProvider=Add {{provider}} provider
flowDescriptionHelp=Help text for the description of the new flow
kc.time.date_time=Date/Time (MM/dd/yyyy hh\:mm\:ss)
principalType=Principal type
ignoreMissingGroupsHelp=Ignore missing groups in the group hierarchy.
updatedCredentialMoveSuccess=User Credential configuration has been saved
deleteExecutorProfileConfirmTitle=Delete executor?
auth=Auth
accessTokenLifespanImplicitFlow=Access Token Lifespan For Implicit Flow
createAttributeSuccess=Success\! User Profile configuration has been saved.
annotations=Annotations
scimSettings=SCIM
scimAttributeMapping=SCIM attribute
scimAttributeMappingHelp=The SCIM attribute this user profile attribute maps to. Select a predefined attribute from the list or type a custom attribute name. For attributes from a SCIM user extension, use the schema URI followed by a dot and the attribute name, for example 'urn:my:params:scim:schemas:extension:custom:1.0:User.team' where the dot separates the schema 'urn:my:params:scim:schemas:extension:custom:1.0:User' from the attribute name 'team'.
scimAttributePlaceholder=Select or type a SCIM attribute
noMatchingScimAttributes=No matching attributes. Continue typing to use a custom attribute name.
scimCoreUserSchema=Core User (urn:ietf:params:scim:schemas:core:2.0:User)
scimEnterpriseUserSchema=Enterprise User (urn:ietf:params:scim:schemas:extension:enterprise:2.0:User)
confirmAccessTokenBody=If you regenerate registration access token, the access data regarding the client registration service will be updated.
remainingCount=Remaining count
eventTypes.INVALID_SIGNATURE.description=Invalid signature
download=Download
authScopes=Authorization scopes
requiredWhen=Required when
requiredWhenTooltip=When scopes are used, attribute is required when at least one of configured scopes is applied in the login request. Both default and optional scopes of current request are evaluated. In the admin console and account console contexts, scopes are not evaluated and attribute is not required.
updatePasswordPolicyError=Could not update the password policies\: '{{error}}'
max-clients.tooltip=It will not be allowed to register a new client if count of existing clients in realm is same or bigger than the configured limit.
uuidLdapAttributeHelp=Name of the LDAP attribute, which is used as a unique object identifier (UUID) for objects in LDAP. For many LDAP server vendors, it is 'entryUUID'; however some are different. For example, for Active directory it should be 'objectGUID'. If your LDAP server does not support the notion of UUID, you can use any other attribute that is supposed to be unique among LDAP users in tree. For example 'uid' or 'entryDN'.
mappingDetails=Mapper details
top-level-flow-type.client-flow=Client flow
eventTypes.GRANT_CONSENT_ERROR.description=Grant consent error
claim=Claim
hardcodedAttribute=When user is imported from provider, hardcode a value to a specific user attribute.
permissionSaveError=Could not update the permission due to {{error}}
optimizeLookupHelp=When signing SAML documents in REDIRECT binding for SP that is secured by Keycloak adapter, should the ID of the signing key be included in SAML protocol message in <Extensions> element? This optimizes validation of the signature as the validating party uses a single key instead of trying every known key for validation.
deleteClientScope_one=Delete client scope {{name}}
accessTokenError=Could not regenerate access token due to\: {{error}}
joinGroups=Join Groups
scopePermissions.clients.configure-description=Reduced management permissions for administrator. Cannot set scope, template, or protocol mappers.
providedBy=Provided by
doNotStoreUsers=Do not store users
ms=milliseconds
ipAddress=IP address
keyID=KEY_ID
spi=SPI
emptyValidators=No validators.
plus=Plus
browserFlow=Browser Flow
anyScope=Any scope
enableDisable=Disabled clients cannot initiate a login or have obtained access tokens.
noUsersFound=No users found
serverInfo=Server info
chooseAPolicyTypeInstructions=Choose one policy type from the list below and then you can configure a new policy for authorization. There are some types and description.
emailThemeHelp=Select a theme for emails that are sent by the server.
principalTypeHelp=Way to identify and track external users from the assertion. Default is using Subject NameID, alternatively you can set up identifying attribute.
Wednesday=Wednesday
consents=Consents
authDetails=Authorization details
mappingDeletedError=Could not delete mapping\: '{{error}}'
minimumQuickLoginWaitSecondsHelp=How long to wait after a quick login failure.
mappedGroupAttributesHelp=List of names of attributes divided by commas. This points to the list of attributes on LDAP group, which will be mapped as attributes of Group in Keycloak. Leave this empty if no additional group attributes are required to be mapped in Keycloak.
deleteGrantsSuccess=Grants successfully revoked.
policyEnforcementModes.DISABLED=Disabled
openIdConnectCompatibilityModes=OpenID Connect Compatibility Modes
no=No
code=Code
nameHelp=Help text for the name of the new flow
keys=Keys
defaultSigAlg=Default Signature Algorithm
signatureKeyName=SAML signature key name
notBeforeTooltip=The admin URL should be set in the Settings tab first.
resourcesToImport=Resources to import
selectRole.label=Select Role
isBinaryAttributeHelp=Should be true for binary LDAP attributes.
whoWillAppearPopoverFooterText=Users who have this role as an effective role cannot be added on this tab.
eventTypes.RESTART_AUTHENTICATION_ERROR.name=Restart authentication error
generatedUserInfoIsDisabled=Generated user info is disabled when no user is selected
nameHelpHelp=Name of the mapper
prompts.consent=Consent
flowNameHelp=Help text for the name of the new flow
webAuthnPolicyRpEntityName=Relying party entity name
lastEvaluation=Last Evaluation
createClientConditionError=Error creating condition\: {{error}}
serverPrincipalHelp=Full name of server principal for HTTP service including server and domain name. For example, HTTP/host.foo.org@FOO.ORG
enableStartTlsHelp=Encrypts the connection to LDAP using STARTTLS, which will disable connection pooling
resourceScopeSuccess=The authorization scope successfully deleted
userIdHelperText=Enter the unique ID of the user for this identity provider.
forwardParametersHelp=Non OpenID Connect/OAuth standard query parameters to be forwarded to external IDP from the initial application request to Authorization Endpoint. Multiple parameters can be entered, separated by comma (,).
on=On
changeAuthenticatorConfirmTitle=Change to {{clientAuthenticatorType}}?
eventTypes.OAUTH2_DEVICE_AUTH.name=OAuth2 device authentication
admin-events-cleared=The admin events have been cleared
or=or
deleteDialogTitle=Delete attribute group?
eventTypes.CLIENT_INITIATED_ACCOUNT_LINKING.description=Client initiated account linking
annotationsText=Annotations
ldapAttributeName=LDAP attribute name
acceptsPromptNone=Accepts prompt\=none forward from client
requiresShortStateParameter=Requires short state parameter
loginThemeHelp=Select theme for login, OTP, grant, registration and forgot password pages.
AESKeySizeHelp=Size in bytes for the generated AES key. Size 16 is for AES-128, Size 24 for AES-192, and Size 32 for AES-256. WARN\: Bigger keys than 128 are not allowed on some JDK implementations.
client-accesstype.tooltip=Access Type of the client, for which the condition will be applied. Confidential client has enabled client authentication when public client has disabled client authentication. Bearer-only is a deprecated client type.
oneTimePassword=One-Time Password
invalidateRotatedError=Could not remove rotated secret\: {{error}}
excludeSessionStateFromAuthenticationResponseHelp=If this is on, the parameter 'session_state' will not be included in OpenID Connect Authentication Response. It is useful if the client uses an older OIDC / OAuth2 adapter, which does not support the 'session_state' parameter.
useRefreshTokenForClientCredentialsGrantHelp=If this is on, a refresh_token will be created and added to the token response if the client_credentials grant is used. The OAuth 2.0 RFC6749 Section 4.4.3 states that a refresh_token should not be generated when client_credentials grant is used. If this is off then no refresh_token will be generated and the associated user session will be removed.
userManagedAccess=User-managed access
initialAccessToken=Initial access token
rowEditBtnAriaLabel=Edit {{messageBundle}}
evictionDay=Eviction day
vendorHelp=LDAP vendor (provider)
applyToResourceType=Apply to Resource Type
addDefaultGroups=Add default groups
selectRole.tooltip=Enter role in the textbox to the left, or click this button to browse and select the role you want.
filterGroups=Filter groups
validPostLogoutRedirectUri=Valid post logout redirect URIs
authnContextClassRefs=AuthnContext ClassRefs
deleteCredentialsSuccess=The credentials has been deleted successfully.
eventTypes.PERMISSION_TOKEN_ERROR.name=Permission token error
userProfileSuccess=User profile settings successfully updated.
attributeDefaultValueHelp=If no value exists in the Keycloak database and the attribute is mandatory in LDAP, this value is propagated to LDAP.
cibaPolicy=CIBA Policy
Saturday=Saturday
importSkipped_other={{count}} records skipped.
membershipAttributeTypeHelp=DN means that the LDAP group members are declared in their full DN form. For example, 'member\: uid\=john,ou\=users,dc\=example,dc\=com'. UID means that the LDAP group members are declared in pure user uid form, such as 'memberUid\: john'.
unsavedChangesTitle=Unsaved changes
emptyResourcesInstructions=If you want to create a resource, please click the button below.
save-user-eventsHelp=If enabled, user events are saved to the database, which makes events available to the admin and account management UIs.
otpSupportedApplications.totpAppFreeOTPName=FreeOTP
validPostLogoutRedirectURIs=Valid URI pattern a browser can redirect to after a successful logout. A value of '+' or an empty field will use the list of valid redirect uris. A value of '-' will not allow any post logout redirect uris. Simple wildcards are allowed such as 'http\://example.com/*'. Relative path can be specified too such as /my/relative/path/*. Relative paths are relative to the client root URL, or if none is specified the auth server root URL is used.
composite=Composite
recommendedSsoTimeout=It is recommended for this value to be shorter than the SSO session idle timeout\: {{time}}
sessionExplain=Sessions are sessions of users in this realm and the clients that they access within the session.
noSearchResults=No search results
eventTypes.AUTHREQID_TO_TOKEN.description=Authreqid to token
recent=Recent
executeActions=Execute actions
policyProvider.aggregate=Reuse existing policies to build more complex ones and keep your permissions even more decoupled from the policies that are evaluated during the processing of authorization requests.
advancedAttributeToRole=If the set of attributes exists and can be matched, grant the user the specified realm or client role.
userEventsSettings=User events settings
deny=Deny
moveGroupSuccess=Group moved
eventTypes.USER_INFO_REQUEST.description=User info request
userDeletedError=The user could not be deleted {{error}}
edit=Edit
authorizationScopeDetails=Authorization scope details
ldapGroupsDnHelp=LDAP DN where groups of this tree are saved. For example 'ou\=groups,dc\=example,dc\=org'.
readOnly=Read only
client-updater-trusted-hosts.tooltip=List of Hosts, which are trusted. In case that client registration/update request comes from the host/domain specified in this configuration, condition evaluates to true. You can use hostnames or IP addresses. If you use star at the beginning (for example '*.example.com' ) then whole domain example.com will be trusted.
resultDeny=Result-Deny
kc.client.network.host=Client Host
noResourceCreateHint=There are no resources. Therefore, you cannot create resource-based permissions.
directMembership=Direct membership
addExecutionTitle=Add an execution
associatedRolesText=Associated roles
clientIdHelp=The client identifier registered with the identity provider.
eventTypes.INVALID_SIGNATURE_ERROR.name=Invalid signature error
clientSecretSuccess=Client secret regenerated
oAuthDeviceCodeLifespan=OAuth 2.0 Device Code Lifespan
ldapConnectionAndAuthorizationSettingsDescription=This section contains options related to the configuration of the connection to the LDAP server. It also contains options related to authentication of the LDAP connection to the LDAP server.
clientSaveSuccess=Client successfully updated
ecdsaGenerated=ecdsca-generated
flow-type.basic-flow=Generic
oAuthDevicePollingInterval=OAuth 2.0 Device Polling Interval
deletedSuccessRealmSetting=The realm has been deleted
webauthnPasswordlessPolicy=WebAuthn Passwordless Policy
editUserLabel=Edit User Label Button
conditions=Conditions
addUri=Add URI
excludeIssuerFromAuthenticationResponse=Exclude Issuer From Authentication Response
minus=Minus
groupsHelp=Groups where the user has membership. To leave a group, click the cross button.
includeGroupsAndRoles=Include groups and roles
groupsPermissionsHint=Determines if fine grained permissions are enabled for managing this role. Disabling will delete all current permissions that have been set up.
searchForTranslation=Search for translation
offlineSessionMaxHelp=Max time before an offline session is expired regardless of activity.
resourceSaveError=Could not persist resource due to {{error}}
updateCredentialUserLabelError=Error changing user label\: {{error}}
enableHelpMode=Enable help mode
clientPoliciesTab=Client policies tab
ldapGroupsDn=LDAP groups DN
ldapFullNameAttributeHelp=Name of the LDAP attribute, which contains the fullName of the user. Usually it will be 'cn'.
clientRegisterPolicyDeleteConfirm=Are you sure you want to permanently delete the client registration policy {{name}}
jsonEditor=JSON editor
mappingCreatedError=Could not create mapping\: '{{error}}'
deleteClientPolicyProfileConfirmTitle=Delete profile?
passwordPoliciesHelp.forceExpiredPasswordChange=The number of days the password is valid before a new password is required.
envelopeFromHelp=An email address used for bounces (optional).
allowutf8Help=Enable to allow UTF-8 characters in the local part of the email address. This should only be enabled if the mail server supports UTF-8 via the SMTPUTF8 extension. If disabled, domain names containing UTF-8 characters will be encoded using punycode, and addresses containing UTF-8 characters in the local part of the address will return an error.
passwordPoliciesHelp.upperCase=The number of uppercase letters required in the password string.
policyDeletedError=Could not remove the resource {{error}}
key=Key
email=Email
groupDeleted_other=Groups deleted
acrToLoAMappingHelp=Define which ACR (Authentication Context Class Reference) value is mapped to which LoA (Level of Authentication). The ACR can be any value, whereas the LoA must be numeric.
acrToLoAMappingSamlHelp=Define which ACR (Authentication Context Class Reference) value is mapped to which LoA (Level of Authentication). The ACR for SAML is an URI, whereas the LoA must be numeric.
acrToLoAMappingRealmSamlHelp=Define which ACR (Authentication Context Class Reference) value is mapped to which LoA (Level of Authentication). The ACR can be any value and is used in OpenID Connect, the URI is the authentication context for SAML and it is an URI, finally the LoA must be numeric.
uploadFile=Upload JSON file
loginActionTimeoutHelp=Max time a user has to complete login related actions like update password or configure totp. This is recommended to be relatively long, such as 5 minutes or more.
identityProviders=Identity providers
importUsers=Import users
authenticationFlow=Authentication flow
leaveGroup_other=Leave groups?
deleteClientPolicySuccess=Client policy deleted
clientAuthentications.client_secret_basic=Client secret sent as HTTP Basic authentication
clientAuthentications.client_secret_basic_unencoded=Client secret sent as HTTP Basic authentication without URL encoding (deprecated)
started=Started
filteredByClaimHelp=If true, ID tokens issued by the identity provider must have a specific claim. Otherwise, the user can not authenticate through this broker.
permissionDecisionStrategyHelp=The decision strategy dictates how the policies associated with a given permission are evaluated and how a final decision is obtained. 'Affirmative' means that at least one policy must evaluate to a positive decision in order for the final decision to be also positive. 'Unanimous' means that all policies must evaluate to a positive decision in order for the final decision to be also positive. 'Consensus' means that the number of positive decisions must be greater than the number of negative decisions. If the number of positive and negative is the same, the final decision will be negative.
userManagedAccessHelp=If enabled, users are allowed to manage their resources and permissions using the Account Management UI.
confirm=Confirm
policyType.totp=Time based
addAttribute=Add {{label}}
clientScopeSearch.protocol=Protocol
initialAccessTokenDetails=Initial access token details
noTranslations=No translations
deleteProvider=Delete provider?
inputTypeSize=Input size
createAttributeSubTitle=Create a new attribute
eventTypes.CODE_TO_TOKEN_ERROR.name=Code to token error
emptyAuthorizationInstructions=If you want to create authorization scopes, please click the button below to create the authorization scope
subjectHelp=Subject DN in the Client Certificate issued for the client. When using a regular expression, you can use "(.*?)(?\:$)" to match all kind of expressions.
casubjectHelp=Subject DN of the root Certificate Authority (CA) that issued the certificate for the client (trust anchor). The CA Subject DN can be in the RFC4514 or RFC1779 format.
eventTypes.CUSTOM_REQUIRED_ACTION.name=Custom required action
updateExecutorError=Executor not updated: {{error}}
clientIdHelpHelp=Client ID of client to which LDAP role mappings will be mapped. Applicable only if 'Use Realm Roles Mapping' is false.
createdAt=Created at
moveGroupEmpty=No sub groups
rolesHelp=Select the roles you want to associate with the selected user.
samlEntityDescriptor=SAML entity descriptor
passwordPolicyHintsEnabled=Password policy hints enabled
enableLdapv3PasswordHelp=Use the LDAPv3 Password Modify Extended Operation (RFC-3062). The password modify extended operation usually requires that LDAP user already has password in the LDAP server. So when this is used with 'Sync Registrations', it can be good to add also 'Hardcoded LDAP attribute mapper' with randomly generated initial password.
enableLdapPasswordPolicy=Enable LDAP password policy
enableLdapPasswordPolicyHelp=Use the LDAP password policy as outlined in IETF draft-behera-ldap-password-policy. When this option is enabled, users will be prompted to change their password upon logging in if the server indicates that a password change is necessary.
syncMode=Sync mode
details=Details
privateRSAKeyHelp=Private RSA Key encoded in PEM format
onDragStart=Dragging started for item {{item}}
pushedAuthorizationRequestRequired=Pushed authorization request required
requirements.REQUIRED=Required
generate=Generate
clientOfflineSessionMaxHelp=Max time before a client offline session is expired. If Offline Session Max Limited is enabled at realm level, offline tokens are invalidated when a client offline session is expired. The option does not affect the global user SSO session. If not set, it uses the realm Offline Session Max value.
resetPasswordBtn=Reset password
strictTransportSecurity=HTTP Strict Transport Security (HSTS)
editInfo=Edit info
offlineSessionMaxLimited=Offline Session Max Limited
providerCreateSuccess=New client policy created successfully
disableSigning=Disable "{{key}}"
periodicChangedUsersSync=Periodic changed users sync
searchScope=Search scope
dateFrom=Date(from)
importAdded_one=One record added.
clientAccessType=It uses the client's access type (confidential, public, bearer-only) to determine whether the policy is applied. Condition is checked during most of OpenID Connect requests (Authorization requests, token requests, introspection endpoint request, etc.). Confidential client has enabled client authentication when public client has disabled client authentication. Bearer-only is a deprecated client type.
firstName=First name
emptySecondaryAction=Configure a new mapper
defaultGroupAdded_one=New group added to the default groups
unexpectedError=An unexpected error occurred\: '{{error}}'
noRolesInstructions=You haven't assigned any roles to this user. Assign a role to get started.
authorizationEncryptedResponseEncHelp=JWA Algorithm used for content encryption in encrypting the authorization response when the response mode is jwt. This option is needed if you want encrypted authorization response. If left empty, the authorization response is just signed, but not encrypted.
permissionName=The name of this permission.
postBrokerLoginFlowAliasHelp=Alias of authentication flow, which is triggered after each login with this identity provider. Useful if you want additional verification of each user authenticated with this identity provider (for example OTP). Leave this to "None" if you need no any additional authenticators to be triggered after login with this identity provider. Also note that authenticator implementations must assume that user is already set in ClientSession as identity provider already set it.
preview=Preview
eventTypes.UNREGISTER_NODE_ERROR.name=Unregister node error
clientRegisterPolicyDeleteConfirmTitle=Delete client registration policy?
groupDetails=Group details
sessionsType.allSessions=All session types
kid=Kid
sessionsType.serviceAccount=Service account
allowKerberosAuthenticationHelp=Enable/disable HTTP authentication of users with SPNEGO/Kerberos tokens. The data about authenticated users will be provisioned from this LDAP server.
oauthDeviceAuthorizationGrantHelp=This enables support for OAuth 2.0 Device Authorization Grant, which means that client is an application on device that has limited input capabilities or lack a suitable browser.
clientSignatureHelp=Will the client sign their saml requests and responses? And should they be validated?
importOverwritten_other={{count}} records overwritten.
requirements.CONDITIONAL=Conditional
leaveGroupConfirmDialog_one=Are you sure you want to remove {{username}} from the group {{groupname}}?
kc.client.user_agent=Client/User Agent
frontendUrl=Frontend URL
permissionDeletedSuccess=Successfully deleted permission
clientScopeRemoveSuccess=Scope mapping successfully removed
addClientScopes=Add client scopes
doNotStoreUsersHelp=When enabled, users from this broker are not persisted in internal database.
deletePolicyConfirm=If you delete this policy, some permissions or aggregated policies will be affected.
userCreateError=Could not create user\: {{error}}
user-events-cleared=The user events have been cleared
resetPasswordConfirm=Reset password?
emailAsUsernameHelpText=Allow users to set email as username.
AESKeySize=AES Key Size
fullName={{givenName}} {{familyName}}
deleteConfirm=Are you sure you want to permanently delete the provider '{{provider}}'?
compositesRemovedAlertDescription=All the associated roles have been removed
aliasHelp=The alias uniquely identifies an identity provider and it is also used to build the redirect uri.
ssfTransmitterIssuerHelp=The issuer URL of the SSF Transmitter. This is used to derive the transmitter metadata endpoint.
ssfTransmitterAccessToken=Access Token
ssfTransmitterAccessTokenHelp=The Transmitter Access Token to perform SSF stream verification.
ssfTransmitterToken=Transmitter Token
ssfTransmitterTokenHelp=The token used to authenticate with the SSF Transmitter.
ssfTransmitterTokenType=Token Type
ssfTransmitterTokenTypeHelp=The type of token to use for authenticating with the SSF Transmitter.
ssfTransmitterTokenType.accessToken=Access Token
ssfTransmitterAuthMethod=Transmitter Authentication
ssfTransmitterAuthMethodHelp=How to authenticate with the SSF Transmitter. Use 'Static Token' to provide a pre-configured bearer token, or 'Client Credentials' to obtain tokens dynamically using the OAuth2 client_credentials grant.
ssfTransmitterAuthMethod.staticToken=Static Token
ssfTransmitterAuthMethod.clientCredentials=Client Credentials
ssfTokenUrlHelp=The token endpoint URL of the authorization server associated with the SSF Transmitter, used to obtain access tokens via client_credentials grant.
ssfScope=Scope
ssfScopeHelp=Space-separated list of OAuth2 scopes to request when obtaining access tokens via client_credentials grant. Leave blank to use the transmitter's default scopes.
transmitterMetadataUrl=Metadata URL
transmitterMetadataUrlHelp=The SSF Transmitter metadata url, e.g. /.well-known/ssf-configuration. Leave blank to derive from issuer URL.
ssfStreamId=Stream ID
ssfStreamIdHelp=ID of the SSF stream registered with the Transmitter.
ssfStreamDescription=Description
ssfStreamDescriptionHelp=Human-readable description supplied by the receiver when it registered the SSF stream.
ssfStreamCreatedAt=Created
ssfStreamCreatedAtHelp=Timestamp at which the receiver originally registered this SSF stream with the transmitter.
ssfStreamManagedBy=Managed by
ssfStreamManagedByHelp=Whether this stream was registered by the SSF receiver via the standard /streams endpoint, or created by a Keycloak admin via the Admin UI. Set at creation time. The stream configuration (description, requested and delivered events) can only be edited here for Keycloak-managed streams; for receiver-managed streams it is read-only and changed by the receiver. The stream status (enable, pause, disable) can always be changed here, regardless of who manages the stream.
ssfStreamManagedByReceiver=Receiver
ssfStreamManagedByKeycloak=Keycloak
ssfStreamUpdateSuccess=Stream configuration has been updated.
ssfStreamUpdateError=Could not update stream configuration\: {{error}}
ssfStreamUpdatedAt=Last modified
ssfStreamUpdatedAtHelp=Timestamp of the most recent change to this SSF stream, including status and configuration updates.
ssfStreamLastVerifiedAt=Last verified
ssfStreamLastVerifiedAtHelp=Timestamp of the most recent verification event dispatched to this stream — set on both receiver-initiated verification requests and admin-initiated verifications from this tab. Empty if the stream has never been verified.
ssfStreamSettings=Stream Settings
ssfDescription=Description
ssfDescriptionHelp=Free-form notes describing this SSF Receiver — e.g. which downstream system it represents, who owns it, what events it consumes. Operator-facing only; not exposed on the receiver-facing wire.
ssfStreamAudience=Audience
ssfStreamAudienceHelp=Audience URI stamped on Security Event Tokens delivered to this receiver. If empty the transmitter falls back to a generated value of the form clientId/streamId so a receiver that registers more than one stream over time can disambiguate them on the wire.
ssfSupportedEvents=Supported Events
ssfSupportedEventsHelp=The SSF event types that this receiver supports (e.g. CaepCredentialChange, CaepSessionRevoked).
ssfNativelyEmittedBadge=built-in
ssfEmitOnlyEvents=Emit-only events
ssfEmitOnlyEventsHelp=Subset of Supported events that Keycloak should NOT auto-emit from native event listeners. Events listed here still travel over the wire when fired explicitly via the synthetic emit endpoint, but Keycloak's automatic mapping skips them. Use this when an event type should reach the receiver only on demand. Empty = every supported event auto-emits (default).
ssfEventsDelivered=Events Delivered
ssfEventsDeliveredHelp=The set of events that the Transmitter will emit to the stream.
ssfEventsDeliveredEmpty=No events are currently being delivered. The delivered set is the intersection of the events the receiver requested and the events it supports.
ssfEventsRequested=Events Requested
ssfEventsRequestedHelp=The set of event types the receiver asked for when it registered this stream.
ssfEventsRequestedEmpty=The receiver did not request any events when it registered the stream.
ssfStreamIdEmpty=No SSF stream registered for this client yet.
ssfDeliveryMethod=Delivery Method
ssfDeliveryMethodHelp=The delivery method used to receive SSF events from the Transmitter.
ssfDeliveryMethod.push=Push
ssfPushAuthorizationHeader=Push Authorization Header
ssfPushAuthorizationHeaderHelp='Authorization' header value expected to be sent by SSF Transmitters when Push delivery via HTTP is used.
ssfTriggerVerification=Trigger Verification
ssfTriggerVerificationSuccess=Stream verification triggered successfully.
ssfTriggerVerificationError=Failed to trigger stream verification: {{error}}
selectRealm=Select realm
roleNameLdapAttribute=Role name LDAP attribute
javaKeystore=java-keystore
updatedUserProfileSuccess=User Profile configuration has been saved
deleteProviderMapper=Delete mapper?
clientsPermissionsHint=Fine grained permissions for administrators that want to manage this client or apply roles defined by this client.
lookAroundHelp=How far around (extra token periods or counts) should the server look just in case the token generator and server are out of time sync or counter sync?
usersLeft_one={{count}} user left the group
sync-keycloak-groups-to-ldap=Sync Keycloak groups to LDAP
saveError=User federation provider could not be saved\: {{error}}
bruteForceDetection=Brute force detection
loginTimeoutHelp=Max time a user has to complete a login. This is recommended to be relatively long, such as 30 minutes or more.
eventTypes.OAUTH2_DEVICE_CODE_TO_TOKEN.name=OAuth2 device code to token
searchGroups=Search groups
trusted-hosts.tooltip=List of Hosts, which are trusted and are allowed to invoke Client Registration Service and/or be used as values of Client URIs. You can use hostnames or IP addresses. If you use star at the beginning (for example '*.example.com' ) then whole domain example.com will be trusted.
disableNonceHelp=Do not send the nonce parameter in the authentication request. The nonce parameter is sent and verified by default.
disableTypeClaimCheckHelp=Disables the validation of the `typ` claim of tokens received from the Identity Provider. If this is `off` the type claim is validated (default).
deleteClientProfile=Delete this client profile
none=None
type=Type
createNewUser=Create new user
emptyClientProfiles=No profiles
internationalization=Internationalization
seconds=Seconds
memberofLdapAttributeHelp=Used just when 'User Roles Retrieve Strategy' is GET_GROUPS_FROM_USER_MEMBEROF_ATTRIBUTE. It specifies the name of the LDAP attribute on the LDAP user, which contains the groups, which the user is member of. Usually it will be the default 'memberOf'.
clientRegisterPolicyDeleteSuccess=Client registration policy deleted successfully
otpPolicyDigits=Number of digits
keysFilter.ACTIVE=Active keys
rsaGenerated=rsa-generated
krbPrincipalAttributeHelp=Name of the LDAP attribute, which refers to Kerberos principal. This is used to lookup appropriate LDAP user after successful Kerberos/SPNEGO authentication in Keycloak. When this is empty, the LDAP user will be looked based on LDAP username corresponding to the first part of his Kerberos principal. For instance, for principal 'john@KEYCLOAK.ORG', it will assume that LDAP username is 'john'.
client-roles-condition.tooltip=Client roles, which will be checked during this condition evaluation. Condition evaluates to true if client has at least one client role with the name as the client roles specified in the configuration.
impersonateError=Could not impersonate the user\: {{error}}
keyLabel=Key
syncChangedUsers=Sync changed users
eventTypes.IDENTITY_PROVIDER_RESPONSE_ERROR.name=Identity provider response error
orderDialogIntro=The order that the providers are listed in the login page or the Account UI. You can drag the row handles to change the order.
clientSessionIdle=Client Session Idle
push=Push
targetClaimHelp=Specifies the target claim which the policy will fetch.
client-attributes-condition.tooltip=Client attributes, that will be checked during this condition evaluation. Condition evaluates to true if the client has all client attributes with the name and value as the client attributes specified in the configuration.
scopePermissions.users.user-impersonated-description=Policies that decide which users can be impersonated. These policies are applied to the user being impersonated.
forceNameIdFormat=Force name ID format
noMappersInstructions=There are currently no mappers for this identity provider.
deleteConfirmFlow=Delete flow?
addRole=Add role
FAIL=Fail import
userInfoSignedResponseAlgorithmHelp=JWA algorithm used for signed User Info Endpoint response. If set to 'unsigned', User Info Response won't be signed and will be returned in application/json format.
lastName=Last name
isAccessTokenJWT=Access Token is JWT
deleteConfirmDialog_one=Are you sure you want to permanently delete {{count}} selected user
eventTypes.AUTHREQID_TO_TOKEN.name=Authreqid to token
createError=Could not create the identity provider\: {{error}}
excludeIssuerFromAuthenticationResponseHelp=If this is on, the parameter 'iss' will not be included in OpenID Connect Authentication Response. It is useful if the client uses an older OIDC / OAuth2 adapter, which does not support the 'iss' parameter.
eventTypes.AUTHREQID_TO_TOKEN_ERROR.name=Authreqid to token error
deletePermissionConfirm=Are you sure you want to delete the permission {{permission}}
TERMS_AND_CONDITIONS=Terms and Conditions (TERMS_AND_CONDITIONS)
artifactResolutionServiceHelp=SAML Artifact resolution service for the client. This is the endpoint to which Keycloak will send a SOAP ArtifactResolve message. You can leave this blank if you do not have a URL for this binding.
userRoleMappingUpdatedSuccess=User role mapping successfully updated
clientUpdaterTrustedHosts=Trusted Hosts
deleteSuccess=Attributes group deleted.
attributesDropdown=Attributes dropdown
ssoServiceUrlHelp=The Url that must be used to send authentication requests (SAML AuthnRequest).
artifactResolutionServiceUrlHelp=The Url that must be used to get SAML assertions from artifacts (SAML ArtifactResolve).
copy=Copy
credentialData=Data
clientRolesConditionTooltip=Client roles, which will be checked during this condition evaluation. Condition evaluates to true if client has at least one client role with the name as the client roles specified in the configuration.
invalidateSecret=Invalidate
emptyPermissionInstructions=If you want to create a permission, please click the button below to create a resource-based or scope-based permission.
webAuthnPolicyAvoidSameAuthenticatorRegisterHelp=Avoid registering an authenticator that has already been registered.
memberofLdapAttribute=Member-of LDAP attribute
supportedLocales=Supported locales
invalidLocale=Invalid locale selected
showPasswordDataValue=Value
adminConsolePreview=Admin Console Preview
loginPagePreview=Login Page Preview
webAuthnPolicyAttestationConveyancePreference=Attestation conveyance preference
copyOf=Copy of {{name}}
eventTypes.REMOVE_TOTP.description=Remove totp
evictionMinute=Eviction minute
requiredClient=Please add at least one client.
help=Help
passSubject=Pass subject
deleteFlowSuccess=Flow successfully deleted
nodeReRegistrationTimeoutHelp=Interval to specify max time for registered clients cluster nodes to re-register. If cluster node will not send re-registration request to Keycloak within this time, it will be unregistered from Keycloak.
rename=Rename
httpPostBindingLogoutHelp=Indicates whether to respond to requests using HTTP-POST binding. If false, HTTP-REDIRECT binding will be used.
policyProvider.client=Define conditions for your permissions where a set of one or more clients is permitted to access an object.
clientAuthentication=Client authentication
validatePasswordPolicy=Validate password policy
registrationEmailAsUsername=Email as username
webAuthnPolicyFormHelp=Policy for WebAuthn authentication. This one will be used by 'WebAuthn Register' required action and 'WebAuthn Authenticator' authenticator. Typical usage is, when WebAuthn will be used for the two-factor authentication.
createResource=Create resource
data=Data
createNewMapper=Create new mapper
deleteNodeFail=Could not delete node\: '{{error}}'
syncModeOverrideHelp=Overrides the default sync mode of the IDP for this mapper. Values are\: 'legacy' to keep the behaviour before this option was introduced, 'import' to only import the user once during first login of the user with this identity provider, 'force' to always update the user during every login with this identity provider and 'inherit' to use the sync mode defined in the identity provider for this mapper.
eventTypes.TOKEN_EXCHANGE_ERROR.description=Token exchange error
strictTransportSecurityHelp=The Strict-Transport-Security HTTP header tells browsers to always use HTTPS. Once a browser sees this header, it will only visit the site over HTTPS for the time specified (1 year) at max-age, including the subdomains. <formattedlink>Learn more</formattedlink>
authenticationExplain=Authentication is the area where you can configure and manage different credential types.
passwordPoliciesHelp.hashIterations=The number of times a password is hashed before storage or verification. Default\: -1 in case argon2 is used as the hashing algorithm; 210,000 in case pbkdf2-sha512 is used as the hashing algorithm; 600,000 if the pbkdf2-sha256 algorithm is used as the hashing algorithm; 1,300,000 if the pbkdf2 algorithm is used as the hashing algorithm.
dropNonexistingGroupsDuringSync=Drop non-existing groups during sync
clientAssertionSigningAlgHelp=Signature algorithm to create JWT assertion as client authentication. In the case of JWT signed with private key or JWT signed with client secret, it is required. If no algorithm is specified, the following algorithm is adapted. RS256 is adapted in the case of JWT signed with private key. HS256 is adapted in the case of JWT signed with client secret.
jwtX509HeadersEnabledHelp=If enabled, the x5t (X.509 Certificate SHA-1 Thumbprint) header will be added to the JWT to reference the certificate used to sign it. Otherwise, the kid (Key ID) header will be used instead.
addProvider_other=Add {{provider}} providers
resetAction=Reset action
cibaExpiresIn=Expires In
parameterizedScopeFormatHelp=This is the regular expression that the system will use to extract the scope name and variable.
updateTranslationError=Error updating translation: {{error}}
resetPasswordConfirmText=Are you sure you want to reset the password for the user {{username}}?
create=Create
noAvailableIdentityProviders=No available identity providers.
passSubjectHelp=During login phase, forward an optional login_hint query parameter to SAML AuthnRequest's Subject.
notBeforeSetToNow=Not Before set for client
notBefore=Not Before
setToNow=Set to now
resource=Resource
emptyConditions=No conditions configured
profiles=Profiles
userSession.modelNote.tooltip=Name of stored user session note within the UserSessionModel.note map.
filterByRoles=Filter by realm roles
maxLifespan=Max lifespan
host-sending-registration-request-must-match.label=Host Sending Client Registration Request Must Match
eventTypes.VERIFY_PROFILE_ERROR.description=Verify profile error
webOriginsHelp=Allowed CORS origins. To permit all origins of Valid Redirect URIs, add '+'. This does not include the '*' wildcard though. To permit all origins, explicitly add '*'.
noSessionsForClient=There are currently no active sessions for this client.
profilesConfigType=Configure via\:
enableHelp=Help is enabled
xRobotsTagHelp=Prevent pages from appearing in search engines. <formattedlink>Learn more</formattedlink>
client-updater-source-roles.label=Updating entity role
clientRegisterPolicyDeleteError=Could not delete client registration policy\: '{{error}}'
resourceFile=Resource file
admin-clearEventsHelp=Deletes all admin events in the database.
hardcodedRole=When user is imported from provider, hardcode a role mapping for it.
searchType.default=Default search
keysFilter.DISABLED=Disabled keys
link=Link
defaultGroupAddedError=Error adding group(s) to the default group {error}
eventTypes.INVALID_SIGNATURE_ERROR.description=Invalid signature error
idpUnlinkSuccess=The provider link has been removed
providerType=Provider Type
clientSessionIdleHelp=Time a client session is allowed to be idle before it expires. Tokens are invalidated when a client session is expired. The option does not affect the global user SSO session. If not set, it uses the standard SSO Session Idle value.
passwordPoliciesHelp.hashAlgorithm=Applies a hashing algorithm to passwords, so they are not stored in clear text.
scopesSelect=Specifies that this permission must be applied to one or more scopes.
selectMethodType.generate=Generate
emailInvalid=You must enter a valid email.
chooseAPolicyProvider=Choose a policy provider
clientAuthenticationHelp=The client authentication method (cfr. https\://openid.net/specs/openid-connect-core-1_0.html\#ClientAuthentication). In case of JWT signed with private key, the realm private key is used.
kerberosRealmHelp=Name of kerberos realm. For example, FOO.ORG.
roleCreateError=Could not create role\: {{error}}
clientSecretHelp=The client secret registered with the identity provider. This field is able to obtain its value from vault, use ${vault.ID} format.
oidcClientSecretHelp=The client secret registered with the client. This field is able to obtain its value from vault, use ${vault.ID} format.
offlineSessionMax=Offline Session Max
generatedUserInfoHelp=See the example User Info, which will be provided by the User Info Endpoint.
parameterizedScopeFormat=Parameterized scope format
parameterizedScopeType=Parameter type
parameterizedScopeTypeHelp=Determines how the scope parameter is validated. The custom type allows defining a custom regex pattern.
regexGroupsNotAllowed=Regex must not contain groups (parentheses).
parameterizedScopeType.string=String
parameterizedScopeType.integer=Integer
parameterizedScopeType.boolean=Boolean
parameterizedScopeType.username=Username
parameterizedScopeType.custom=Custom
parameterizedScopeType.delegation=Delegation
repeatableScope=Repeatable
repeatableScopeHelp=When enabled, this scope can appear multiple times in a single request with different parameter values. When disabled, only one parameter value is allowed per request.
webAuthnPolicyExtraOriginsHelp=The list of extra origins for non-web applications.
webAuthnPolicyPasskeysEnabledHelp=Enable passkeys (conditional UI) authentication in the username forms.
webAuthnPolicyMediationHelp=Controls how the browser presents the passkey selection dialog when the login page loads.
updatePermissionSuccess=Successfully updated the permission
idpLinkSuccess=Identity provider has been linked
removeAnnotationText=Remove annotation
verifyEmailHelpText=Require user to verify their email address after initial login or after address changes are submitted.
referrerPolicy=Referrer Policy
referrerPolicyHelp=Default value prevents pages from being included. <formattedlink>Learn more</formattedlink>
flow.clients=Client authentication flow
eventTypes.IDENTITY_PROVIDER_FIRST_LOGIN_ERROR.description=Identity provider first login error
groups=Groups
emptyStateText=There aren't any realm roles in this realm. Create a realm role to get started.
includeSubGroups=Include sub-group users
permanentLockoutHelp=Configures whether a user is temporarily or permanently disabled after too many login failures. Permanent lockout can be configured to occur after a number of login failures or after a number of temporary lockouts.
logicType.positive=Positive
associatedPolicy=Associated policy
accountTheme=Account theme
webAuthnPolicyAvoidSameAuthenticatorRegister=Avoid same authenticator registration
emptyExecutors=No executors configured
notBeforeNowClear=Not Before cleared for client
selectARole=Select a role
titleAuthentication=Authentication
category=Category
startBySearchingAUser=Start by searching for users
times.days=Days
selectALocale=Select a locale
transientUser=Transient
transientUserTooltip=This user not stored in Keycloak database. It is constructed solely from data provided by the originating identity provider.
error-empty=Please specify value of '{{0}}'.
error-invalid-blank=Please specify value of '{{0}}'.
error-invalid-date='{{0}}' is invalid date.
error-invalid-email=Invalid email address.
error-invalid-length-too-long='{{0}}' must have maximal length of {{2}}.
error-invalid-length-too-short='{{0}}' must have minimal length of {{1}}.
error-invalid-length='{{0}}' must have a length between {{1}} and {{2}}.
error-invalid-number='{{0}}' is invalid number.
error-invalid-uri-fragment='{{0}}' is invalid URL fragment.
error-invalid-uri-scheme='{{0}}' has invalid URL scheme.
error-invalid-uri='{{0}}' is invalid URL.
error-invalid-value='{{0}}' has invalid value.
error-number-out-of-range-too-big='{{0}}' must have maximal value of {{2}}.
error-number-out-of-range-too-small='{{0}}' must have minimal value of {{1}}.
error-number-out-of-range='{{0}}' must be a number between {{1}} and {{2}}.
error-pattern-no-match='{{0}}' doesn't match required format.
error-person-name-invalid-character='{{0}}' contains invalid character.
error-user-attribute-required=Please specify '{{0}}'.
error-username-invalid-character='{{0}}' contains invalid character.
error-user-attribute-read-only=The field {{0}} is read only.
error-non-ascii-local-part-email=Local part of the address must contain only ASCII characters.
missingUsernameMessage='{{0}}': Please specify username.
missingFirstNameMessage='{{0}}': Please specify first name.
invalidEmailMessage='{{0}}': Invalid email address.
missingLastNameMessage='{{0}}': Please specify last name.
missingEmailMessage='{{0}}': Please specify email.
missingPasswordMessage='{{0}}': Please specify password.
updateReadOnlyAttributesRejectedMessage=Update of read-only attribute rejected
locales=Locales
realmOverrides=Realm overrides
realmOverridesHelp=You can only edit the supported locales. If you haven't selected supported locale yet, you only can edit English locale.
effectiveMessageBundles=Effective message bundles
effectiveMessageBundlesHelp=You can search for effective message bundles based on themes, features, language, and free text.
deleteMessageBundle=Delete message bundle {{key}}
deleteAllTranslationsSuccess=Successfully removed translation(s).
deleteAllTranslationsError=Error removing translation(s), {{error}}
noRealmOverridesSearchResultsInstructions=Click on the search bar above to search for realm overrides
emptyEffectiveMessageBundles=Search for effective messages
emptyEffectiveMessageBundlesInstructions=You can search for the effective messages you want by theme, feature and language in the search box above.
searchForEffectiveMessageBundles=Search for message bundle
selectAll=Select all
theme=Theme
themeType=Theme Type
language=Language
hasWords=Has words
deleteConfirmTranslationTitle=Delete translation(s)?
translationDeleteConfirmDialog=Are you sure you want to permanently delete {{count}} selected translation(s)?
selectTheme=Select theme
selectThemeType=Select theme type
selectLanguage=Select language
referral=Referral
referralHelp=Specifies if LDAP referrals should be followed or ignored. Please note that enabling referrals can slow down authentication as it allows the LDAP server to decide which other LDAP servers to use. This could potentially include untrusted servers.
authenticatorRefConfig.value.help=Add a custom reference name for the authenticator. When this authenticator is successfully completed during an authentication flow, the Authentication Method Reference (AMR) protocol mapper will use this value to populate the amr claim of the generated tokens. Note, the AMR protocol must be configured for the given client to populate the AMR claim.
authenticatorRefConfig.value.label=Authenticator Reference
authenticatorRefConfig.maxAge.help=The max age in seconds that the authenticator reference value is good for in an SSO session. When the Authentication Method Reference (AMR) protocol mapper is used, the AMR will only be considered valid and populated in the token if the authenticator execution was completed within the specified max age.
authenticatorRefConfig.maxAge.label=Authenticator Reference Max Age
loa-condition-level=Level of Authentication (LoA)
loa-condition-level.tooltip=Level of authentication. This value should be always integer, which is greater or equal to 0. The subflows in the authentication flow should be always ordered from lowest levels to a higher levels.
loa-max-age=Max Age
loa-max-age.tooltip=Maximum age in seconds for this level of authentication to be valid. If the particular level is requested and user already authenticated with this level earlier than specified amount of seconds ago, he will not be asked to re-authenticate. But if he authenticated later than specified amount of seconds ago, he will need to re-authenticate with this level again. Value 0 in the configuration means that user is always required to re-authenticate with this level whenever this level is requested.
includeInLightweight.label=Add to lightweight access token
includeInLightweight.tooltip=Should the claim be added to the lightweight access token?
lightweightAccessToken=Always use lightweight access token
lightweightAccessTokenHelp=If it is On, lightweight access tokens are always used. If it is Off, they are not used by default, but it is still possible to enable them with client policy executor.
supportJwtClaimInIntrospectionResponse=Support JWT claim in Introspection Response
supportJwtClaimInIntrospectionResponseHelp=If it is On, introspection requests which use the header 'Accept: application/jwt' will also contain a claim named "jwt" with the claims of the introspection result encoded as JWT access token.
allowTokenIntrospectionWithoutAudienceCheck=Allow token introspection without audience check
allowTokenIntrospectionWithoutAudienceCheckHelp=Allows this client to introspect tokens without audience validation. This option is deprecated and will be removed in some future release. Only enable for backward compatibility during migration.
allowUserinfoWithLightweightAccessToken=Allow UserInfo with lightweight access token
allowUserinfoWithLightweightAccessTokenHelp=Allows lightweight access tokens issued by this client to be used with the UserInfo endpoint. Lightweight tokens are designed for token introspection. This option is deprecated and will be removed in some future release. Only enable for backward compatibility during migration.
ssf=SSF
ssfTransmitterEnabled=SSF Transmitter
ssfTransmitterEnabledHelp=If enabled, this realm acts as a Shared Signals Framework (SSF) Transmitter and exposes the SSF Configuration Metadata endpoint. Disabling for a realm with active streams will delete queued events for those receivers on save; pause or delete the streams first if you want receivers notified via a stream-updated SET before going silent.
ssfTransmitterDisableConfirmTitle=Disable SSF Transmitter for this realm?
ssfTransmitterDisableConfirmIntro=Disabling the SSF Transmitter feature for this realm has the following effects\:
ssfTransmitterDisableConfirmBulletEndpoints=All SSF Transmitter endpoints (metadata, streams, subjects, status, SSE) will return 404 to receivers.
ssfTransmitterDisableConfirmBulletEvents=No new user or admin events will be recorded for SSF receivers in this realm.
ssfTransmitterDisableConfirmBulletDelivery=All queued events for receivers in this realm (PENDING and HELD) will be deleted on save. They cannot be recovered.
ssfTransmitterDisableConfirmBulletReceivers=Receivers are not notified that streams went silent. They simply stop seeing events.
ssfTransmitterDisableConfirmRecommendation=Recommended\: pause or delete the active SSF streams in this realm before saving so receivers get a proper stream-updated notification before delivery stops.
ssfTransmitterDisableConfirmContinue=Disable transmitter
ssfTransmitterDisableEventsCleared=Queued SSF events for this realm have been deleted.
ssfTransmitterDisableEventsClearFailed=Failed to delete queued SSF events for this realm
ssfReceiver=SSF Receiver
ssfTabReceiver=Receiver
ssfTabStream=Stream
ssfTabSubjects=Subjects
ssfTabEventSearch=Event Search
ssfTabEmitEvents=Emit Events
ssfPendingEventsHelp=Look up the delivery state of a specific SSF event by its jti, or emit a synthetic event for this receiver from the admin console.
ssfPendingLookupJti=Event jti
ssfPendingLookupJtiHelp=JWT id of the Security Event Token — returned from the emit action below or taken from transmitter logs.
ssfPendingLookupJtiPlaceholder=jti-of-the-event
ssfPendingLookup=Lookup
ssfPendingLookupNotFound=No pending event found for this jti on this receiver.
ssfPendingLookupResult=Result
ssfPendingFieldStatus=Status
ssfPendingFieldEventType=Event type
ssfPendingFieldDeliveryMethod=Delivery method
ssfPendingFieldAttempts=Attempts
ssfPendingFieldCreatedAt=Created at
ssfPendingFieldNextAttemptAt=Next attempt at
ssfPendingFieldDeliveredAt=Delivered at
ssfPendingFieldLastError=Last error
ssfPendingFieldDecodedSet=Security Event Token (decoded)
ssfPendingFieldUserId=Resolved user
ssfLookupTitle=Look up event
ssfLookupTitleHelp=Inspect the delivery state of a specific Security Event Token by its jti. Scoped to this receiver.
ssfEmitTitle=Emit synthetic event
ssfEmitTitleHelp=Push a synthetic event to this receiver. The transmitter formats the sub_id per the receiver's configured User Subject Format and applies the same subscription filters as native events.
ssfEmitEventType=Event type
ssfEmitEventTypeHelp=One of the event types this receiver's transmitter can emit. The payload below is deserialized against the event class registered for the selected type.
ssfEmitEventTypeSelectPrompt=-- select an event type --
ssfEmitEventTypeRequired=Select an event type to emit.
ssfEmitSubjectValueHelp=Resolves to a Keycloak user (user-id / user-email / user-username) or organization (org-alias). For user subjects the transmitter builds the sub_id using the receiver's configured User Subject Format so the emitted SET matches the shape of a native event for this receiver; org subjects emit a complex tenant-only subject. Subject-subscription filters and the format-specific fail-loud rules (no email, no organization for +tenant) still apply.
ssfEmitSubjectValueRequired=A subject value is required.
ssfEmitPayload=Event payload (JSON)
ssfEmitPayloadHelp=Event-specific body — must deserialize against the selected event type's class. Leave empty to emit an empty payload (only meaningful for event types with no required fields). Supported placeholders (expanded before JSON parsing): __now__ resolves to the current Unix time in seconds. Usable unquoted for numeric fields, e.g. "event_timestamp": __now__.
ssfEmitPayloadInvalidJson=Payload is not valid JSON: {{error}}
ssfEmitEvent=Emit event
ssfEmitResult=Emitted — status={{status}}, jti={{jti}}
ssfEmitResultLookupLink=Look up this event in Event Search
ssfEmitErrorSubjectNotFound=Subject not found: {{type}} = {{value}}
ssfEmitErrorInvalidRequest=Invalid request: {{detail}}
ssfEmitErrorNoDeliveryConfig=The stream has no delivery method configured, so the event cannot be delivered. Configure push or poll delivery for the stream first.
ssfEmitErrorUnknown=Emit failed: {{detail}}
ssfReceiverHelp=Transmitter-side policy applied when Keycloak delivers Security Event Tokens to this receiver.
ssfSectionGeneral=General
ssfSectionGeneralHelp=Identity, display, and stream behaviour for this SSF receiver: profile and description, the audience targeted, which subjects are delivered for, subject identifier format, verification policy, and the grace window applied when receivers remove subjects. Applied whenever a stream is registered or updated for this client.
ssfSectionAuthentication=Authentication
ssfSectionAuthenticationHelp=Access rules that gate who can manage this receiver's SSF stream and invoke the synthetic event emission endpoint.
ssfSectionDelivery=Delivery
ssfSectionDeliveryHelp=Which delivery methods this receiver may use and, when push delivery is allowed, the URL prefixes the transmitter is permitted to push Security Event Tokens to.
ssfSectionEvents=Events
ssfSectionEventsHelp=Which event types this receiver advertises and delivers, age and inactivity constraints that bound the outbox, and whether admins may emit synthetic events for debugging or workflow integration.
ssfAllowedDeliveryMethods=Allowed delivery methods
ssfAllowedDeliveryMethodsHelp=Which delivery methods this receiver may select when registering a stream. At least one method must be enabled. The receiver picks one of the allowed methods at stream-create time; restricting this list to poll-only forbids the transmitter from making outbound HTTP calls to this receiver entirely.
ssfAllowedDeliveryMethods.push=Push delivery
ssfAllowedDeliveryMethods.pushHelp=Transmitter POSTs Security Event Tokens to a receiver-supplied URL (RFC 8935). Requires Valid push URLs to be configured below.
ssfAllowedDeliveryMethods.poll=Poll delivery
ssfAllowedDeliveryMethods.pollHelp=Receiver pulls queued Security Event Tokens from a transmitter-owned poll endpoint (RFC 8936). The endpoint URL is generated by Keycloak; no per-receiver allow-list is needed.
ssfValidPushUrls=Valid push URLs
ssfValidPushUrlsHelp=Allow-list of URL patterns the receiver may register as its push endpoint. Each entry is matched against the receiver-supplied URL using exact match or trailing-* suffix wildcard (e.g. https://receiver/push/* permits any tenant + stream id under that path). A URL outside the allow-list is rejected with HTTP 400 — this is the receiver's SSRF defence. Bare * is not honoured.
ssfValidPushUrls.add=Add valid push URL
ssfReceiverEnabled=SSF Receiver
ssfReceiverEnabledHelp=If enabled, this client acts as a Shared Signals Framework (SSF) Receiver. Keycloak will transmit security events to this client according to the configured SSF stream.
ssfStream=SSF Stream
ssfStreamHelp=The stream registered for this receiver and its event delivery settings.
ssfStreamNotRegistered=No SSF stream registered yet
ssfStreamNotRegisteredHelp=This receiver client has not registered an SSF stream with the transmitter yet. You can create one on its behalf below, or the receiver can create one itself via the SSF Transmitter API.
ssfCreateStream=Create stream
ssfCreateStreamReset=Clear
ssfCreateStreamSuccess=SSF stream created successfully.
ssfCreateStreamError=Could not create SSF stream\: {{error}}
ssfCreateStreamDeliveryMethod=Delivery method
ssfCreateStreamDeliveryMethodHelp=The SSF delivery method to use for this stream. Push (RFC 8935) sends signed SETs to a receiver-hosted endpoint; Poll (RFC 8936) hosts the endpoint on the transmitter and the receiver pulls SETs on its own schedule. Push requires the receiver to provide its own endpoint URL; Poll uses a transmitter-generated URL returned in the create response.
ssfCreateStreamEndpointUrl=Push endpoint URL
ssfCreateStreamEndpointUrlHelp=HTTPS URL on the receiver side that the transmitter will POST Security Event Tokens to.
ssfCreateStreamEndpointUrlRequired=A push endpoint URL is required.
ssfCreateStreamEndpointUrlInvalid=Push endpoint URL must be an absolute http or https URL.
ssfCreateStreamEventsRequested=Events requested
ssfCreateStreamEventsRequestedHelp=The SSF event types the receiver should be subscribed to. Pick from the events the transmitter is configured to emit; leave empty to use the transmitter's default supported set.
ssfCreateStreamDescription=Description
ssfCreateStreamDescriptionHelp=Optional human-readable label for the stream, surfaced in this admin UI for operators.
ssfStreamAudienceCurrentHelp=The audience currently configured on the registered SSF stream. Updating the Stream Audience field in the SSF Receiver section only affects streams that the receiver registers after the change.
ssfStreamPushEndpointUrl=Push endpoint URL
ssfStreamPushEndpointUrlHelp=HTTPS URL on the receiver side that the transmitter POSTs Security Event Tokens to. Only shown for streams using the HTTP push delivery method.
ssfStreamPollEndpointUrl=Poll endpoint URL
ssfStreamPollEndpointUrlHelp=Transmitter-hosted URL the receiver POSTs to in order to pull pending Security Event Tokens (RFC 8936). The receiver authenticates with its own bearer token; no transmitter-side authorization header is configured.
ssfStreamPushAuthHeader=Push Authorization header
ssfStreamPushAuthHeaderHelp=Value sent in the Authorization request header on every push (for example a bearer token) as is.
ssfDeleteStream=Delete Stream
ssfDeleteStreamConfirmTitle=Delete SSF stream?
ssfDeleteStreamConfirmMessage=The registered SSF stream for this client will be deleted and the receiver will have to re-create it. This cannot be undone. Continue?
ssfDeleteStreamSuccess=SSF stream deleted successfully.
ssfSubjects=SSF Subjects
ssfSubjectsHelp=Manage which users or organizations this receiver gets events about. Use Check to see whether a subject is currently included.
ssfSubjectType=Subject type
ssfSubjectTypeHelp=How the value below is interpreted when looking up the subject. User options resolve to a Keycloak user by email, ID, or username; Organization (by alias) resolves to a Keycloak organization. The notification preference is stored as the ssf.notify.${clientId} attribute on the resolved entity.
ssfSubjectType.userEmail=User (by email)
ssfSubjectType.userId=User (by ID)
ssfSubjectType.userUsername=User (by username)
ssfSubjectType.orgAlias=Organization (by alias)
ssfSubjectValue=Subject value
ssfSubjectAdd=Add subject
ssfSubjectRemove=Remove subject
ssfSubjectCheck=Check
ssfSubjectStatusLabel=Subject status
ssfSubjectValueRequired=Please enter a subject value.
ssfSubjectNotFound=Subject not found. Verify the value and subject type.
ssfSubjectIsNotified=Events for this subject are delivered to this stream.
ssfSubjectIsNotifiedViaOrg=Subject is included via an organization membership for this stream.
ssfSubjectIsNotifiedViaOrgNamed=Subject is included via membership in organization '{{org}}' for this stream.
ssfSubjectIsImplicitlyIncluded=Subject is implicitly included in event delivery for this stream (default_subjects=ALL and no explicit exclusion).
ssfSubjectIsNotNotified=Subject is not included in event delivery for this stream.
ssfSubjectAdded=Subject has been added to this stream.
ssfSubjectIgnore=Ignore subject
ssfSubjectIgnored=Subject has been ignored for this stream.
ssfSubjectIsIgnored=Subject is explicitly excluded from event delivery for this stream.
ssfSubjectIsIgnoredViaOrg=Subject is excluded via an organization membership for this stream.
ssfSubjectIsIgnoredViaOrgNamed=Subject is excluded via membership in organization '{{org}}' for this stream.
ssfSubjectRemoved=Subject has been removed from this stream.
ssfSubjectActionError=Could not update subject notification preference\: {{error}}
ssfDeleteStreamError=Could not delete SSF stream\: {{error}}
ssfVerifyStream=Verify
ssfVerifyStreamSuccess=Verification event dispatched to the receiver.
ssfVerifyStreamError=Could not send verification event\: {{error}}
ssfProfile=Profile
ssfProfileHelp=The Shared Signals Framework profile to use when transmitting events to this receiver.
ssfProfile.SSF_1_0=SSF 1.0
ssfProfile.SSE_CAEP=SSE CAEP 1.0
ssfCreateStreamProfileHelp=The SSF profile applied to events sent over this stream. Profile is a per-receiver setting, so changing it here also updates the receiver clients profile attribute before the stream is created.
ssfUserSubjectFormat=Subject Format
ssfUserSubjectFormatHelp=Subject identifier format the transmitter uses for the user portion of SSF Security Event Tokens. Defaults to iss_sub (realm issuer + user ID). Select email to emit the user's email address instead. The +tenant variants wrap the user subject in a complex subject and add a tenant sibling carrying the user's Keycloak organization alias — use this when the receiver expects multi-tenant routing. Events are dropped (with a clear log entry) when the selected format cannot be produced (e.g. email selected but the user has no email, or +tenant selected but the user belongs to no organization).
ssfUserSubjectFormat.iss_sub=iss_sub (Issuer and Subject)
ssfUserSubjectFormat.email=email
ssfUserSubjectFormat.complex.iss_sub+tenant=complex(iss_sub + tenant organization)
ssfUserSubjectFormat.complex.email+tenant=complex(email + tenant organization)
ssfDefaultSubjects=Default Subjects
ssfDefaultSubjectsHelp=Controls whether the transmitter delivers events for all realm users (ALL) or only for users explicitly added via the add-subject endpoint or the Subjects tab (NONE). Receivers can override this per-stream at creation time.
ssfDefaultSubjects.ALL=ALL (deliver events for all subjects)
ssfDefaultSubjects.NONE=NONE (deliver only for added subjects)
ssfAutoNotifyOnLogin=Add subject on login
ssfAutoNotifyOnLoginHelp=When enabled and Default Subjects is set to NONE, users that log in via this client are automatically added to the set of subjects this receiver gets events about — equivalent to clicking Add for them on the Subjects tab. Useful for federated scenarios where only users that authenticate through this client should be included in event delivery.
ssfRequireServiceAccount=Require service account
ssfRequireServiceAccountHelp=When enabled, only the client's own service account can access the SSF transmitter API. This is the default behavior when not explicitly set. Disable for clients that use the authorization code flow where a real user authenticates and the receiver backend uses the resulting token to manage its SSF stream.
ssfRequiredRole=Required role
ssfRequiredRoleHelp=When set, the authenticated user must hold this role (realm role or client role on this client) to access the SSF transmitter API. Checked in addition to the service account requirement (if enabled) and the scope requirement. Leave empty to skip the role check.
ssfAllowEmitEvents=Emit events enabled
ssfAllowEmitEventsHelp=When enabled, a service account holding the role configured below can push synthetic SSF events for this receiver via the admin emit endpoint. Use this for environments where Keycloak cannot natively observe upstream events (e.g. credential changes that happen in LDAP). If no role is configured the endpoint is refused. Callers that have permission to manage this client bypass the role check.
ssfEmitEventsRole=Required emit events role
ssfEmitEventsRoleHelp=Role the calling service account must hold to push synthetic events. Select a realm role or a client role on this receiver. Only applies when "Synthetic events" is enabled.
ssfMinVerificationInterval=Min Verification Interval
ssfMinVerificationIntervalHelp=Minimum amount of time in seconds that must pass between receiver-initiated verification requests for this client's stream. Subsequent requests within this window are rejected with HTTP 429. Leave empty to use the transmitter-wide default.
ssfMaxEventAge=Max event age
ssfMaxEventAgeHelp=Maximum age (in seconds) of pending, held, or dead-letter outbox events for this receiver. Older rows are purged by the transmitter's housekeeping pass before the global dead-letter retention window applies. Use a short value for receivers whose events lose relevance fast (e.g. session-revoked). Leave inherited to fall back to the transmitter-wide retention only.
ssfInactivityTimeout=Inactivity timeout
ssfInactivityTimeoutHelp=SSF 1.0 inactivity_timeout — if no eligible receiver activity (any hit on the stream-management API, or a poll for POLL streams) arrives within this window, the transmitter automatically pauses the stream and sends a stream-updated event. Activity is tracked at a 5-minute granularity (write-coalesced to avoid hammering the client store on busy pollers), so the effective check may fire up to 5 minutes late — pick timeouts comfortably larger than that. Leave empty for no timeout.
ssfSubjectRemovalGrace=Subject removal grace
ssfSubjectRemovalGraceHelp=SSF 1.0 ‘Malicious Subject Removal’ defense. After a receiver-driven /streams/subjects/remove the transmitter keeps delivering events for the subject for this many seconds, defending against a compromised receiver bearer token silently silencing events for a target. Admin-driven removes always take effect immediately. Leave empty to inherit the transmitter-wide subject-removal-grace-seconds SPI default; set to 0 to opt this receiver out of the grace window even when the transmitter default is positive (e.g. for receivers that legitimately remove subjects when users churn out of their service).
ssfAutoVerifyStream=Auto-Verify Stream
ssfAutoVerifyStreamHelp=When enabled, the transmitter automatically dispatches a stream-verification SET shortly after the receiver creates a stream. When disabled, the receiver can perform the verification by sending an explicit verification request to the verification endpoint.
ssfVerificationDelay=Verification Delay
ssfVerificationDelayHelp=Delay in milliseconds before the transmitter sends the verification event after the stream is created. Only applies when Auto-Verify Stream is enabled.
ssfStreamStatus=Status
ssfStreamStatusHelp=Current status of the SSF stream for this client. Use the action buttons below to change it — those go through the SSF spec-mandated transition path, which dispatches a stream-updated SET to the receiver and aligns the outbox backlog with the new status.
ssfStreamStatus.enabled=Enabled
ssfStreamStatus.paused=Paused
ssfStreamStatus.disabled=Disabled
ssfStreamStatusEnable=Enable stream
ssfStreamStatusPause=Pause stream
ssfStreamStatusDisable=Disable stream
ssfStreamStatusUpdateSuccess=Stream status updated. A stream-updated event has been dispatched to the receiver.
ssfStreamStatusUpdateError=Could not update stream status\: {{error}}
ssfStreamStatusLabel=Stream status
ssfStreamIndicator.enabled=Enabled
ssfStreamIndicator.paused=Paused
ssfStreamIndicator.disabled=Disabled
ssfStreamIndicator.registered=Registered
ssfStreamIndicator.unregistered=Not registered
ssfStreamStatusReason=Status reason
ssfStreamStatusReasonHelp=Human-readable reason associated with the current stream status, if one was supplied when the status was last changed (for example by a receiver pausing or disabling the stream).
ssfDelivery=Delivery Method
ssfDeliveryHelp=The delivery method the transmitter uses for events on this stream. Push (RFC 8935) sends signed SETs to the receiver's endpoint; Poll (RFC 8936) holds events in the transmitter outbox until the receiver pulls them via the transmitter-hosted poll endpoint.
ssfDelivery.PUSH=Push
ssfDelivery.POLL=Poll
ssfDelivery.PULL=Pull
ssfPushEndpointConnectTimeout=Push Connect Timeout
ssfPushEndpointConnectTimeoutHelp=Connect timeout in milliseconds when delivering SSF events via HTTP push to the receiver's push endpoint.
ssfPushEndpointSocketTimeout=Push Socket Timeout
ssfPushEndpointSocketTimeoutHelp=Socket (read) timeout in milliseconds when delivering SSF events via HTTP push to the receiver's push endpoint.
welcomeTabTitle=Welcome
welcomeTo=Welcome to {{realmDisplayInfo}}
welcomeText=Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users.
viewDocumentation=Refer to documentation
viewGuides=View guides
joinCommunity=Join community
readBlog=Read blog
customValue=Custom value
termsAndConditionsUserAttribute=Terms and conditions accepted timestamp
realmOverridesDescription=Realm overrides allow you to specify translations that will take effect for the entire realm. These translations will override any translation specified by a theme.
addTranslation=Add translation
effectiveMessageBundlesDescription=An effective message bundle is the set of translations for a given language, theme, and theme type. It also takes into account any realm overrides, which will take precedence.
clientsClientScopesHelp=The scopes associated with this resource.
searchItem=Search item
createItem=Create item
itemDelete=Delete item
itemDeleteConfirm=Are you sure you want to permanently delete the item?
itemDeleteConfirmTitle=Delete item?
itemDeletedSuccess=The item has been deleted
itemDeleteError=Could not delete item: {{error}}
noItems=There are no items
noItemsInstructions=You have not created any items in this realm. Create an item to get started.
itemSaveError=Error could not save item\! {{error}}
itemSaveSuccessful=Saved successfully
realmSelector=Realm selector
editTranslationValue=Edit translation value
selectAccessTokenSignatureAlgorithm=Select access token signature algorithm
selectIdTokenSignatureAlgorithm=Select Id token signature algorithm
selectIdTokenEncryptionKeyManagementAlgorithm=Select Id token encryption key management algorithm
selectIdTokenEncryptionContentEncryptionAlgorithm=Select Id token encryption content encryption algorithm
selectUserInfoSignedResponseAlgorithm=Select user info signed response algorithm
selectUserInfoResponseEncryptionKeyManagementAlgorithm=Select user info response encryption key management algorithm
selectUserInfoResponseEncryptionContentEncryptionAlgorithm=Select user info response encryption content encryption algorithm
selectRequestObjectSignatureAlgorithm=Select request object signature algorithm
selectRequestObjectEncryption=Select request object encryption
selectRequestObjectEncoding=Select request object encoding
selectRequestObjectRequired=Select request object required
selectAuthorizationSignedResponseAlgorithm=Select authorization signed response algorithm
selectAuthorizationEncryptedResponseAlg=Select authorization encrypted response alg
selectAuthorizationEncryptedResponseEnc=Select authorization encrypted response enc
generatedCodeTextArea=Generated code textarea
selectAuthScopes=Select authorization scopes
selectResource=Select resource
selectClients=Select clients
selectLoginTheme=Select login theme
selectAccountTheme=Select account theme
selectAdminTheme=Select admin theme
selectEmailTheme=Select email theme
selectFilterType=Select filter type
selectUnmanagedAttributePolicy=Select unmanaged attribute policy
selectEventsListeners=Select events listeners
selectCachePolicy=Select cache policy
selectEvictionDay=Select eviction day
selectEvictionHour=Select eviction hour
selectEvictionMinute=Select eviction minute
selectEditMode=Select edit mode
emptySelection=Empty selection
readOnlySelection=Read only selection
writableSelection=Writable selection
unsyncedSelection=Unsynced selection
selectMapperType=Select mapper type
editBtn=Edit button
acceptBtn=Accept editing button
cancelBtn=Cancel editing button
chooseBindingType=Choose binding type
selectFlowType=Select flow type
selectClientAssertionSigningAlg=Select client assertion signing algorithm
resourceDetailsTypeHelp=The type of this resource. It can be used to group different resource instances with the same type.
selectVendor=Select vendor
spinnerLoading=Loading
enableClientSignatureRequiredModal=Enable client signature required
selectBindType=Select bind type
searchClientAuthorizationResource=Search resource
searchClientAuthorizationPolicy=Search policy
searchClientAuthorizationPermission=Search permission
userNotSaved=The user has not been saved\: {{error}}
kcNumberFormat=Number Format
kcNumberUnFormat=Number UnFormat
tokenExpirationHelp=Sets the expiration for tokens. Expired tokens are periodically deleted from the database.
bruteForceMode.Disabled=Disabled
bruteForceMode.PermanentLockout=Lockout permanently
bruteForceMode.TemporaryLockout=Lockout temporarily
bruteForceMode.PermanentAfterTemporaryLockout=Lockout permanently after temporary lockout
bruteForceMode=Brute Force Mode
error-invalid-multivalued-size=Attribute {{0}} must have at least {{1}} and at most {{2}} value(s).
multivalued=Multivalued
multivaluedHelp=If this attribute supports multiple values. This setting is an indicator and does not enable any validation.
defaultValue=Default value
defaultValueHelp=Default value when attribute value is not specified.
to the attribute. For that, make sure to use any of the built-in validators to properly validate the size and the values.
sendIdTokenOnLogout=Send 'id_token_hint' in logout requests
sendIdTokenOnLogoutHelp=If the 'id_token_hint' parameter should be sent in logout requests.
sendClientIdOnLogout=Send 'client_id' in logout requests
sendClientIdOnLogoutHelp=If the 'client_id' parameter should be sent in logout requests.
addAttributeTranslationBtn=Add translation button
addAttributeTranslationInfo=Add translations for this field using the icon next to the "{{fieldName}}" field.
addAttributeTranslation=Add translation for the "{{fieldName}}" field
addAttributeDisplayDescriptionTranslation=Add translation for the display description
addTranslationsModalTitle=Add translations
addTranslationsModalSubTitle=You are able to translate the "{{fieldName}}" based on your locale or preferred languages. In addition, you are also able to create or edit the "{{fieldName}}" translations in the <1>Realm settings > Localization > Realm overrides.</1>
translationKey=Key
translationsTableHeading=Translations
searchForLanguage=Search for language
supportedLanguagesTableColumnName=Supported languages
translationTableColumnName=Translation
defaultLanguage=Default
translationValue=Translation value
noLanguages=No languages
noLanguagesInstructions=Add a language in Realm settings > Localization > Locales to get started.
addTranslationsDialogRowsTable=Add a translations dialog rows table
addTranslationDialogHelperText=The translation based on the default language is required.
noLanguagesSearchResultsInstructions=Click on the search bar above to search for languages
addTranslationDialogOkBtn=Ok
translationError=Please add translations before saving: {{error}}
fetchRoles=Fetch Roles
fetchRolesHelp=By default, only the roles available from the token sent with the authorization requests are used to check if the user is granted with a role. If this setting is enabled, the policy will ignore roles from the token and check any role associated with the user instead.
emptyAdminEvents=No admin events
emptyAdminEventsInstructions=There are no admin events in this realm.
emptyUserEvents=No user events
emptyUserEventsInstructions=There are no user events in this realm.
smtpFromPlaceholder=Sender email address
smtpFromDisplayPlaceholder=Display name for Sender email address
replyToEmailPlaceholder=Reply to email address
replyToDisplayPlaceholder=Display name for "reply to" email address
senderEnvelopePlaceholder=Sender envelope email address
smtpPortPlaceholder=SMTP port (defaults to 25)
loginUsernamePlaceholder=Login username
ownerHelp=Owner for this resource.
parRequestUriLifespan=Lifetime of the Request URI for Pushed Authorization Request
parRequestUriLifespanHelp=Number that represents the lifetime of the request URI. The default value is 1 minute.
identityBrokeringLink=Identity brokering link
searchClientRegistration=Search for policy
importFileHelp=File to import a key
logo=Logo
logoWidth=Logo width
logoHeight=Logo height
avatarImage=Avatar image
eventTypes.INVITE_ORG.name=Invite user to organization
eventTypes.INVITE_ORG.description=Invite user to organization
eventTypes.INVITE_ORG_ERROR.name=Invite user to organization error
eventTypes.INVITE_ORG_ERROR.description=Invite user to organization error
organizationsEnabled=Organizations
organizationsEnabledHelp=If enabled, allows managing organizations. Otherwise, existing organizations are still kept but you will not be able to manage them anymore or authenticate their members.
adminPermissionsEnabled=Admin Permissions
adminPermissionsEnabledHelp=If enabled, allows managing admin permissions in the realm.
verifiableCredentialsEnabled=Verifiable Credentials
verifiableCredentialsEnabledHelp=If enabled, allows managing verifiable credentials in this realm.
verifiableCredentials=Verifiable credentials
credentialScopeName=Credential scope name
revision=Revision
noVerifiableCredentials=No verifiable credentials
noVerifiableCredentialsText=No verifiable credentials have been created for this user.
createVerifiableCredential=Create verifiable credential
createVerifiableCredentialSuccess=Verifiable credential successfully created.
createVerifiableCredentialError=Could not create verifiable credential\: {{error}}
revokeVerifiableCredentialTitle=Revoke verifiable credential?
revokeVerifiableCredentialConfirm=Are you sure you want to revoke the verifiable credential "{{credentialScopeName}}" from this user?
revokeVerifiableCredentialSuccess=Verifiable credential successfully revoked.
revokeVerifiableCredentialError=Could not revoke verifiable credential\: {{error}}
updateVerifiableCredentialTitle=Update verifiable credential?
updateVerifiableCredentialConfirm=Are you sure you want to update the verifiable credential "{{credentialScopeName}}"? This will refresh the user attributes snapshot and increment the revision.
updateVerifiableCredentialSuccess=Verifiable credential successfully updated.
updateVerifiableCredentialError=Could not update verifiable credential\: {{error}}
updateCredential=Update credential
credentialUserAttributes=User attributes
credentialNoUserAttributes=No user attributes
credentialViewAttributes=View attributes
credentialUserAttributesFor=User attributes for "{{credentialScopeName}}"
credentialAttributeName=Attribute name
credentialAttributeValue=Attribute value
selectCredentialScope=Select a credential scope
noOid4vcScopesAvailable=No OID4VC client scopes are available in this realm. Create OID4VC client scopes first.
issuedCredentialId=ID
issuedAt=Issued At
walletClient=Wallet Client
issuedCredentials=Issued Credentials
noIssuedCredentials=No credentials have been issued yet
loadIssuedCredentialsError=Failed to load issued credentials\: {{error}}
revokeIssuedCredentialTitle=Revoke issued credential?
revokeIssuedCredentialConfirm=Are you sure you want to revoke this issued credential? This action cannot be undone.
revokeIssuedCredentialSuccess=Issued credential successfully revoked.
revokeIssuedCredentialError=Failed to revoke issued credential\: {{error}}
credentialOfferSend=Send credential offer
credentialOfferSendConfirm=Send email
credentialOfferEmailSuccess=Credential offer email sent successfully.
credentialOfferEmailError=Failed to send email with credential offer
sendCredentialOfferLifespanHelp=Lifespan for how long the credential offer email link would be valid. If user do not obtain credential offer link from his email within this interval, the credential offer link will be invalid. In that case, new email would need to be send or user would need to obtain verifiable credential offer himself - for example from the account console.
outdated=Outdated
viewIssuedCredentials=View issued credentials
organizations=Organizations
organizationDetails=Organization details
organizationsList=Organizations
caseSensitiveOriginalUsername=Case-sensitive username
caseSensitiveOriginalUsernameHelp=If enabled, the original username from the identity provider is kept as is when federating users. Otherwise, the username from the identity provider is lower-cased and might not match the original value if it is case-sensitive. This setting only affects the username associated with the federated identity as usernames in the server are always in lower-case.
supportsClientAssertions=Supports client assertions
supportsClientAssertionsHelp=This setting enables support for using client assertions issued by the provider to authenticate clients. This requires to set Issuer and keys of this Identity provider. Keys can be set by setup of 'JWKS URL' or 'Validating public key' options above, which are shown when this option is enabled.
supportsClientAssertionReuse=Allows client assertions to be re-used
supportsClientAssertionReuseHelp=By default, a client assertion can not be used multiple times. If the client is not able to retrieve a new client assertion for each request this option can be enabled to allow re-use of the same client assertion.
allowClientIdAsAudience=Allows Client ID as audience for assertions
allowClientIdAsAudienceHelp=If enabled, the Client ID configured in the Identity Provider is the only valid audience for assertions used in Federated client authentication and in JWT Authorization Grants (Client Assertions and JWT Authorization Grant). The client ID is used instead of the token-url/issuer-url defined in the respective specifications. Note this behavior is not covered by any standard.
fedClientAssertionMaxExp=Max expiration for Client Assertions
fedClientAssertionMaxExpHelp=Maximum allowed expiration time for Federated Client Assertions.
organizationsExplain=Manage your organizations and members.
emptyOrganizations=No organizations
emptyOrganizationsInstructions=There is no organization yet. Please create an organization and manage it.
searchOrganization=Search for organization
domains=Domains
organizationDelete=Delete organization?
organizationDeleteConfirm=Are you sure you want to permanently delete this organization? If so, all the data of this organization will be deleted.
organizationDeletedSuccess=The organization has been deleted
orgainzatinoDeleteError=Could not delete client\: {{error}}
createOrganization=Create organization
domain=Domain
organizationDomainHelp=A set of one or more internet domains associated with the organization. The domain is used to map users to an organization based on their email domain and to authenticate them accordingly in the scope of the organization.
addDomain=Add domain
organizationAliasHelp=The alias uniquely identifies an organization using a format that is mainly targeted for referencing the organization internally. For instance, when issuing organization-related claims into tokens or when in a custom theme.
organizationRedirectUrlHelp=Automatically redirect the user after completing registration or accepting an invitation to the organization. If left empty, the user will be redirected to the account console by default.
redirectUrl=Redirect URL
disableConfirmOrganizationTitle=Disable organization?
disableConfirmOrganization=Are you sure you want to disable this organization?
memberList=Member list
searchMember=Search member
addRealmUser=Add realm user
inviteMember=Invite member
inviteNewUser=Invite new user
inviteRealmUser=Invite realm user
removeMember=Remove member
organizationSaveSuccess=Organization successfully saved.
organizationSaveError=Could not save the organization\: {{error}}
emptyMembers=No members
emptyMembersInstructions=There are no members yet. Please add them to this organization
organizationUsersAdded_one={{count}} user added to the organization
organizationUsersAddedError=Could not add users to the organization\: {{error}}
organizationUsersAdded_other={{count}} users added to the organization
organizationUsersLeftError=Could not remove users from the organization\: {{error}}
organizationUsersLeft_one=User left the organization
organizationUsersLeft_other={{count}} users left the organization
inviteSent=Invitation has been sent.
inviteSentError=Could not send invitation\: {{error}}
organizationInvitationsSent_one=Invitation sent to realm user
organizationInvitationsSent_other=Invitations sent to {{count}} realm users
organizationInvitationsSentError=Could not invite users to the organization\: {{error}}
noIdentityProvider=No identity providers in this realm
noIdentityProviderInstructions=There are no identity providers yet in this realm. If you want to link an identity provider with this organization, please go to the "Identity providers" section in the left navigation bar and create an identity provider
linkIdentityProvider=Link identity provider
unLinkIdentityProvider=Unlink provider
emptyIdentityProviderLink=No identity provider in this organization
emptyIdentityProviderLinkInstructions=There is no identity provider yet in this organization. Please link an identity provider with this organization.
searchProvider=Search for provider
selectIdentityProvider=Select an identity provider
shownOnLoginPage=Shown on login page
shownOnLoginPageHelp=When checked this identity provider is shown on the login page.
linkSuccessful=Identity provider successfully linked to organization
linkError=Could not link identity provider to organization\: {{error}}
unLinkSuccessful=Identity provider has been unlinked
unlinkError=Could not unlink identity provider from organization\: {{error}}
linkUpdatedSuccessful=Identity provider link successfully updated
linkUpdateError=Could not update the link to the identity provider\: {{error}}
noResultsFound=No results found
linkedOrganization=Linked organization
organization=Organization
send=Send
redirectWhenEmailMatches=Redirect when email domain matches
redirectWhenEmailMatchesHelp=Automatically redirect the user to this identity provider when the email domain matches the domain
emailVerificationHelp=Independent timeout for email verification
idpAccountEmailVerificationHelp=Independent timeout for IdP account email verification
forgotPasswordHelp=Independent timeout for forgot password
executeActionsHelp=Independent timeout for execute actions
validatingX509CertsHelp=The public certificates used by Keycloak to validate the signatures of SAML requests and responses from the external IDP when the Use metadata descriptor URL is OFF. Multiple certificates can be entered separated by commas (,). You can reimport certificates from the Metadata descriptor URL by clicking the Import Keys action on the identity provider page. This action downloads the current certificates in the metadata endpoint and assigns them to the config in this same option. Click Save to definitely store the re-imported certificates.
emptyUserOrganizations=No organizations
emptyUserOrganizationsInstructions=There is no organization yet. Please join an organization or send an invitation to join an organization.
joinOrganization=Join organization
sendInvite=Send invite
sendInvitation=Send invitation
removeConfirmOrganizationTitle=Remove organization?
organizationRemoveConfirm_one=Are you sure you want to remove user from the selected organization?
organizationRemoveConfirm_other=Are you sure you want to remove user from the {{count}} selected organizations?
organizationRemovedSuccess=User removed from organizations
organizationRemoveError=Could not remove user from organizations\: {{error}}
organizationName=Organization name
userAddedOrganization_one=Organization added to the user
userAddedOrganizationError=Could not add organizations to the user\: {{error}}
userAddedOrganization_other={{count}} organizations added to the user
userInvitedOrganization_one=Invite to user sent
userInvitedOrganizationError=Could not invite user to the organizations\: {{error}}
userInvitedOrganization_other={{count}} invites to users sent
sentInvitation=Sent invitation
loggedInAsTempAdminUser=You are logged in as a temporary admin user. To harden security, create a permanent admin account and delete the temporary one.
temporaryAdmin=Temporary admin user account. Ensure it is replaced with a permanent admin user account as soon as possible.
temporaryService=Temporary admin service account. Ensure it is replaced with a permanent admin service account as soon as possible.
addOrganizationAttributes.label=Add organization attributes
addOrganizationAttributes.help=If enabled, the organization attributes will be available for each organization mapped to the token.
addOrganizationId.label=Add organization id
addOrganizationId.help=If enabled, the organization id will be available for each organization mapped to the token.
addOrganizationDomain.label=Add organization domain
addOrganizationDomain.help=If enabled, the organization domain matching the user's email domain will be available for each organization mapped to the token.
addGroupRoleMappings.label=Add group role mappings
addGroupRoleMappings.help=If enabled, realm and client roles assigned to the user's organization groups will be included in the token for each organization.
identityProviderUnlink=Unlink identity provider?
identityProviderUnlinkConfirm=Are you sure you want to unlink this identity provider?
disableConfirmUserTitle=Disable user?
disableConfirmUser=Are you sure you want to disable this user?
eventTypes.UPDATE_CREDENTIAL.name=Update credential
eventTypes.UPDATE_CREDENTIAL.description=Update credential
eventTypes.UPDATE_CREDENTIAL_ERROR.name=Update credential error
eventTypes.UPDATE_CREDENTIAL_ERROR.description=Update credential error
eventTypes.REMOVE_CREDENTIAL.name=Remove credential
eventTypes.REMOVE_CREDENTIAL.description=Remove credential
eventTypes.REMOVE_CREDENTIAL_ERROR.name=Remove credential error
eventTypes.REMOVE_CREDENTIAL_ERROR.description=Remove credential error
groupDuplicated=Group duplicated
duplicateAGroup=Duplicate group
couldNotFetchClientRoleMappings=Could not fetch client role mappings\: {{error}}
duplicateGroupWarning=Duplication of groups with a large number of subgroups is not supported. Please ensure that the group you are duplicating does not have a large number of subgroups.
darkModeEnabled=Dark mode
darkModeEnabledHelp=If enabled, the dark variant of the theme is applied based on user preference through an operating system setting (light or dark mode) or a user agent setting. If disabled, only the light variant is used. This setting applies only to themes that support dark and light variants. If a theme does not support this feature, this setting has no effect.
showMemberships=Show memberships
showGroupMemberships=Show group memberships
showMembershipsTitle={{username}} Group Memberships
noGroupMembershipsText=This user is not a member of any groups.
noGroupMemberships=No memberships
termsAndConditionsDeclined=You need to accept the Terms and Conditions to continue
somethingWentWrong=Something went wrong
somethingWentWrongDescription=Sorry, an unexpected error has occurred.
tryAgain=Try again
errorSavingTranslations=Error saving translations\: '{{error}}'
clearCachesTitle=Clear Caches
realmCache=Realm Cache
userCache=User Cache
keysCache=Keys Cache
crlCache=CRL Cache
clearButtonTitle=Clear
clearRealmCacheHelp=This will clear entries for all realms.
clearUserCacheHelp=This will clear entries for all realms.
clearKeysCacheHelp=Clears all entries from the cache of external public keys. These are keys of external clients or identity providers. This will clear all entries for all realms.
clearCrlCacheHelp=Clears all entries from the CRL cache. The CRL cache improves the performance of the X.509 authenticator when Certificate Revocation List (CRL) are enabled. This action will clear all the CRL entries for all the realms.
clearCacheSuccess=Cache cleared successfully
clearCacheError=Could not clear cache\: {{error}}
expandRow=Expand row
membershipType=Membership type
managedMembership=Managed membership
filterByMembershipType=Filter by Membership Type
organizationsMembersListError=Could not fetch organization members\: {{error}}
MANAGED=Managed
UNMANAGED=Unmanaged
deleteConfirmUsers_one=Delete user {{name}}?
deleteConfirmUsers_other=Delete {{count}} users?
downloadThemeJar=Download theme JAR
uploadGeneratedThemeJar=Upload generated theme JAR
themeColorInfo=Here you can set the patternfly color variables and create a "theme jar" file that you can download and put in your providers folder to apply the theme to your realm.
permissionsSubTitle=Permissions control access to a resource or multiple resources of one type.
signatureAlgorithmIdentityProviderMetadata=Signature algorithm SAML IdP metadata
signatureAlgorithmIdentityProviderMetadataHelp=Signature algorithm to use for the SAML identity provider metadata, if none the metadata is not signed.
connectionTrace=Connection trace
connectionTraceHelp=If enabled, incoming and outgoing LDAP ASN.1 BER packets will be dumped to the error output stream. Be careful when enabling this option in production as it will expose all data sent to and from the LDAP server.
savingUserEventsOff=Saving user events turned off
savingAdminEventsOff=Saving admin events turned off
membershipEvents=Membership events
childGroupEvents=Child group events
titlePermissions=Permissions
emptyPermissionsInstructions=No permissions exist in this realm.
permissionsName=Permission name
permissionsAssignedPolicy=Assigned policy
chooseAResourceType=Choose a resource type
chooseAResourceTypeInstructions=Choose a resource type for which you will create a permission.
resourceType.Clients=Controls access to operations that can be performed for clients in this realm
resourceType.Groups=Controls access to operations that can be performed for groups in this realm
resourceType.IdentityProviders=Controls access to operations that can be performed for identity providers in this realm
resourceType.Organizations=Controls access to operations that can be performed for organizations in this realm
resourceType.Roles=Controls access to operations that can be performed for roles in this realm
resourceType.Users=Controls access to operations that can be performed for users in this realm
createPermissionOfType=This permission will be applied to the {{resourceType}}
permissionUsersHelpText=Specifies which user(s) are allowed by this permission.
permissionNameHelpText=The name of the permission. This name is used to identify the permission in the admin console.
resourceScope=Resource scope
resourceScopeHelpText=Specifies the scope of the resource. This is used to determine the type of resource that the permission is granted to.
allClients=All clients
specificClients=Specific clients
allResourceType=All {{resourceType}}
specificResourceType=Specific {{resourceType}}
assignedPolicies=Assigned policies
assignExistingPolicies=Assign existing policies
requiredPolicies=Please add at least one policy.
createNewPolicy=Create new policy
policy=Policy
policyType=Policy type
policyTypeHelpText=Specifies the type of policy. This is used to determine the type of policy that the permission is granted to.
emptyAssignExistingPolicies=No existing policies
emptyAssignExistingPoliciesInstructions=There are no existing policies to assign
authorizationScope=Authorization scope
adminPermissionName=Permission name
noAssignedPolicies=No assigned policies
noAssignedPoliciesInstructions=There are no assigned policies for this permission
unAssignPolicy=Unassign
assignedPolicyType.allTypes=All types
assignedPolicyType.user=User
authorizationScopeDetailsTitle=Authorization scope details
authorizationScopeDetailsSubtitle=Authorization scope defines the actions that can be performed on a resource.
authorizationScopeDetailsName=Name
authorizationScopeDetailsDescription=Description
allResources=All resources
currentRealm=Current realm
recentlyUsed=Recently used
viewAll=View all
currentRealmExplain=This realm is selected
removeInvalidUsers=Remove invalid users during searches
removeInvalidUsersHelp=Remove users from the local database if they are not available from the user storage when executing searches. If this is true, users no longer available from their corresponding user storage will be deleted from the local database whenever trying to look up users. If false, then users previously imported from the user storage will be kept in the local database, as read-only and disabled, even if that user is no longer available from the user storage. For example, user was deleted directly from LDAP or the `Users DN` is invalid. Note that this behavior will only happen when the user is not yet cached.
createPermissionPolicy=Create policy
enforceAccessTo=Enforce access to
enforceAccessToHelpText=Specifies the resource that the permission is applied to.
emptyPermissionPoliciesInstructions=No policies exist in this realm.
noPermissionSearchResultsInstructions=No permissions matched your filters.
deleteAdminPermissionConfirm=If you delete permission {{ permission }}, administrators cannot perform the actions on resources that were defined by the permission.
authorizationScope.Clients.configure=Performs basic management of a client
authorizationScope.Clients.manage=Fully manages a client
authorizationScope.Clients.map-roles=Map roles defined by this client to resources such as users and groups
authorizationScope.Clients.map-roles-client-scope=Applies roles defined by this client to the client scope of another client
authorizationScope.Clients.map-roles-composite=Applies roles defined by this client as a composite to another role
authorizationScope.Clients.token-exchange=Controls which clients can exchange tokens for a token that is targeted to this client
authorizationScope.Clients.view=Views this client
authorizationScope.Users.impersonate=Impersonates other users
authorizationScope.Users.manage=Manages all users in the realm
authorizationScope.Users.manage-group-membership=Manages group membership for all users in the realm (used in conjunction with a group policy)
authorizationScope.Users.map-roles=Maps roles for all users
authorizationScope.Users.view=Views all users in the realm
authorizationScope.Groups.manage=Manages this group
authorizationScope.Groups.manage-members=Manages group members
authorizationScope.Groups.manage-membership=Adds or removes group members
authorizationScope.Groups.view=Views this group
authorizationScope.Groups.view-members=Views group members
authorizationScope.IdentityProviders.token-exchange=Allows clients to exchange tokens for tokens issued by this identity provider
authorizationScope.Roles.map-role-client-scope=Applies this role to the client scope of a client
authorizationScope.Roles.map-role-composite=Applies this role as a composite to another role
authorizationScope.Roles.map-role=Maps this role to a user or group
usersResources=Users
clientsResources=Clients
groupsResources=Groups
resourceTypeHelpText=Specifies which {{resourceType}} are allowed by this permission. If left blank, it is the same as selecting all.
evaluation=Evaluation
addSubFlowTo=Add sub-flow to {{name}}
addExecutionTo=Add execution to {{name}}
addConditionTo=Add condition to {{name}}
targetAudience=Target audience
targetAudienceHelp=Configure target audience. This will be the same as using the parameter 'audience' in the token endpoint grant request. Note that the 'audience' parameter is available just for the token-exchange grant at this moment. To simulate any other grant or to simulate token-exchange grant without 'audience' parameter, it is recommended to leave this parameter empty.
targetAudiencePlaceHolder=Select target audience for token exchange
permissionsEvaluationInstructions=Select a user to check if the user has a specific access to the specified resource. After clicking the Evaluate button below, the result will be displayed on the right panel.
permissionEvaluationPreview=Permission evaluation preview
noPermissionsEvaluationResults=No evaluation
noPermissionsEvaluationResultsInstructions=Please setup the permission evaluation in the left side
authScope=Authorization scope
authScopeSelectHelp=Select an authorization scope that is going to be used to query permissions from the server.
resourceTypeSelectHelp=Select a resource type that is going to be used to query permissions from the server.
grantedScope=Granted scope:
deniedScope=Denied scope:
evaluatedPolicy={{name}} voted to {{status}}
permissionEvaluationAlertTitle=The selected user does not have access to the selected resource(s)
deleteConfirmRealm_one=Delete realm {{name}}?
deleteConfirmRealm_other=Delete {{count}} realms?
recentRealms=Recent realms
manageRealms=Manage realms
cantDeleteMasterRealm=You can not delete the master realm!
selectRole=Select role
selectUsers=Select user
selectClient=Select client
forbiddenAdminConsole=You do not have permission to access this resource, sign in with a user that has permission, or contact your administrator.
grantedPermissions=Granted Permissions
deniedPermissions=Denied Permissions
authenticationType=Authentication Type
authenticationTypeBasicAuth=Password
authenticationTypeTokenAuth=Token
authTokenUrl=Auth Token URL
tokenTokenUrlHelp=Token endpoint for gathering tokens: keycloak example: http://localhost/auth/realms/my-realm/protocol/openid-connect/token
authTokenScope=Auth Token Scope
authTokenScopeHelp=The scope(s) separated by blanks, used during token gathering as scope parameter, e.g. 'basic sendmail'
authTokenClientId=Auth Token ClientId
authTokenClientIdHelp=The client_id used during token gathering, e.g. mykeycloak-sendmail-client
authTokenClientSecret=Auth Token Client Secret
enableDebugSMTP=Enable Debug SMTP
signatureMaxExp=Max expiration
signatureMaxExpHelp=Maximum expiration allowed for the JWT. Tokens need to be generated right before authentication. After this period will be considered invalid because they are too old. If undefined the default value is 60 seconds.
fileNameDialogTitle=Save as
fileName=File name
themeName=Theme name
themeDescription=Theme description
themeDescriptionDefault=Custom theme created by the Quick theme tool.
syncUsersStarted=User sync has started.
userProfileClaims=User profile claims
userIDClaim=ID Claim
userIDClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's unique identifier. If not provided, defaults to `sub`.
userNameClaim=Username Claim
userNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's username. If not provided, defaults to `preferred_username`.
emailClaim=Email Claim
emailClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's email. If not provided, defaults to `email`.
fullNameClaim=Name Claim
fullNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's full name. If not provided, defaults to `name`.
givenNameClaim=Given name Claim
givenNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's given name. If not provided, defaults to `given_name`.
familyNameClaim=Family name Claim
familyNameClaimHelp=The name of the claim from the JSON document returned by the user profile endpoint representing the user's family name. If not provided, defaults to `family_name`.
samlClientEncryptionAlgorithm=Encryption algorithm
samlClientEncryptionAlgorithmHelp=Encryption algorithm used for the client. Default AES_256_GCM.
samlClientKeyEncryptionAlgorithm=Key transport algorithm
samlClientKeyEncryptionAlgorithmHelp=Key transport algorithm used for the client to encrypt the secret key used for encryption. Default value RSA-OAEP-11.
samlClientEncryptionDigestMethod=Digest method for RSA-OAEP
samlClientEncryptionDigestMethodHelp=Digest method to use when any RSA-OAEP algorithm is selected as the key transport algorithm. Default value SHA-256.
samlClientEncryptionMaskGenerationFunction=Mask generation function
samlClientEncryptionMaskGenerationFunctionHelp=Mask generation function to use when RSA-OAEP-11 is selected as the key transport algorithm. Default value mgf1sha256.
openIdVerifiableCredentials=OpenID for Verifiable Credentials
openIdVerifiableCredentialsHelp=This section is used to configure settings related to OpenID for Verifiable Credential Issuance (OID4VCI).
oid4vciEnabled=Enable OID4VCI
oid4vciEnabledHelp=Enable this option to allow the client to request verifiable credentials from Keycloak's OID4VCI credential endpoint.
oid4vciAttesterTrustIdps=OID4VCI Attester Trust Identity Providers
oid4vciAttesterTrustIdpsHelp=Trust-material identity providers containing trusted attester public keys for key attestation validation.
noAccessPolicies=No access policies
noAccessPoliciesInstructions=There haven't been configured any access policies yet. Click the button below to configure the first policy.
includeInOpenIdProviderMetadata=Include in OpenID Provider Metadata
includeInOpenIdProviderMetadataHelp=If on, this client scope will be included in OpenID Provider Metadata.
# standard error responses OAuth
invalid_request=Invalid request
unauthorized_client=Unauthorized client
access_denied=Access denied
unsupported_response_type=Unsupported response type
invalid_scope=Invalid scope
server_error=Server error
temporarily_unavailable=Temporarily unavailable
# standard error responses OIDC
interaction_required=Interaction required
login_required=Login required
account_selection_required=Account selection required
consent_required=Consent required
invalid_request_uri=Invalid request uri
invalid_request_object=Invalid request object
request_not_supported=Request not supported
request_uri_not_supported=Request uri not supported
registration_not_supported=Registration not supported
oid4vciAttributes=OID4VCI attributes
oid4vciNonceLifetime=OID4VCI Nonce Lifetime
oid4vciNonceLifetimeHelp=The lifetime of the OID4VCI nonce.
credentialOfferLifespan=Credential Offer Lifespan
credentialOfferLifespanHelp=The default lifespan of credential offers. Applies to both the authorization code and pre-authorized code grant flows.
oid4vciFormValidationError=Please ensure the OID4VCI attribute fields are filled with values 30 seconds or greater.
signedMetadataLifespan=Signed Metadata Lifespan
signedMetadataLifespanHelp=The lifetime of the signed metadata. After this time, the signed metadata will expire.
signedMetadataSigningAlgorithm=Signed Metadata Signing Algorithm
signedMetadataSigningAlgorithmHelp=The algorithm used to sign the issuer metadata. This ensures the integrity and authenticity of the metadata.
requireRequestEncryption=Require Request Encryption
requireRequestEncryptionHelp=If enabled, encryption is required for credential requests on top of TLS. Wallets must encrypt requests using the supported request encryption metadata.
requireResponseEncryption=Require Response Encryption
requireResponseEncryptionHelp=If enabled, encryption is required for credential responses on top of TLS. Wallets must provide encryption keys in the credential request.
enableDeflateCompression=Enable DEF compression
enableDeflateCompressionHelp=If enabled, the DEF compression algorithm is supported for credential requests. This allows clients to compress their requests to reduce payload size.
batchIssuanceSize=Batch Issuance Size
batchIssuanceSizeHelp=The maximum number of credentials that can be issued in a single batch request. This helps manage server load and response times.
timeClaimCorrelationMitigation=Time-claim correlation mitigation
timeClaimsStrategy=Strategy to apply to time claims
timeClaimsStrategyHelp=Strategy to apply to time claims. Supported values: off, randomize, round.
randomizeWindow=Randomize Window
randomizeWindowHelp=When strategy is randomize, subtract a random number of seconds between 0 and the value of this attribute from the original timestamp to mitigate correlation attacks.
roundUnit=Round Unit
roundUnitHelp=When strategy is round, truncate timestamps to the selected unit boundary (UTC). Supported values: SECOND, MINUTE, HOUR, DAY.
randomize=Randomize
round=Round
second=Second
day=Day
# OID4VCI Credential Configuration
credentialConfigurationId=Credential Configuration ID
credentialConfigurationIdHelp=The unique identifier for this credential configuration. This ID is used in the credential issuer metadata and credential requests.
credentialIdentifier=Credential Identifier
credentialIdentifierHelp=A specific identifier for this credential type. This can be used to distinguish between different variants of the same credential type.
credentialOfferRequired=Credential Offer Required
credentialOfferRequiredHelp=The Issuer requires a credential offer for this credential configuration.
issuerDid=Issuer DID
issuerDidHelp=The Decentralized Identifier (DID) of the credential issuer. This identifies who is issuing the verifiable credentials.
credentialLifetime=Credential Lifetime
credentialLifetimeHelp=The lifetime of the issued credential. After this time, the credential will expire and cannot be refreshed. The wallet can refresh the credential to obtain a new VC as long as this lifetime has not been exceeded.
bindingRequired=Cryptographic binding required
bindingRequiredHelp=If enabled, this credential configuration requires cryptographic holder binding and corresponding proofs. If disabled, no cryptographic binding is required and related metadata will be omitted.
cryptographicBindingMethodsSupported=Cryptographic binding methods
cryptographicBindingMethodsSupportedHelp=Comma-separated list of representations of the cryptographic key material the credential will be bound to (for example: jwk). If empty, no cryptographic binding methods will be advertised.
cryptographicBindingMethodsSupportedInvalid=Unsupported binding method(s): {{invalid}}. Allowed values: jwk
bindingSupportedProofTypes=Supported proof types
bindingSupportedProofTypesHelp=Comma-separated list of proof types accepted when cryptographic binding is enabled (for example: jwt). If empty, no proof types will be advertised and proofs will not be enforced.
bindingSupportedProofTypesInvalid=Unsupported proof type(s): {{invalid}}. Allowed values: jwt, attestation
supportedFormats=Supported Formats
supportedFormatsHelp=The format of the verifiable credential. Currently supported formats: SD-JWT VC (dc+sd-jwt), JWT VC (jwt_vc).
credentialRefreshInterval=Credential Refresh Interval
credentialRefreshIntervalHelp=How often the wallet should refresh the credential. The actual VC returned to the wallet will have its expiration set to this interval. The refresh token remains valid for the full credential lifetime, allowing regular renewal. If not set, defaults to 7 days or the credential lifetime, whichever is smaller.
refreshIntervalCannotExceedLifetime=Credential refresh interval ({{interval}}) cannot exceed credential lifetime ({{lifetime}}). The refresh token expires with the credential lifetime.
credentialDisplay=Credential Display
credentialDisplayHelp=JSON array of objects containing display metadata for wallets (name, logo, colors, etc.). Example: [{"name": "IdentityCredential", "locale": "en-US", "logo": {"uri": "https://example.com/logo.png", "alt_text": "Logo"}, "background_color": "#12107c", "text_color": "#FFFFFF"}]
credentialSigningAlgorithm=Credential Signing Algorithm
credentialSigningAlgorithmHelp=Signing algorithm used to select the active realm key for signing credentials (e.g., "ES256"). If not specified, the active key will be selected using the realm's default algorithm. This option is disabled if a specific 'Signing Key ID' is selected.
hashAlgorithm=Hash Algorithm
hashAlgorithmHelp=Hash algorithm used for SD-JWT credentials (for example "SHA-256"). Defaults to "SHA-256" if not specified.
supportedCredentialTypes=Supported Credential Types
supportedCredentialTypesHelp=Comma-separated list of credential types (e.g., "VerifiableCredential,UniversityDegreeCredential"). Used in the credential definition for JWT VC and SD-JWT formats. When this option is not configured, the name of the client scope will be used as a 'type' claim of the corresponding credential.
verifiableCredentialType=Verifiable Credential Type (VCT)
verifiableCredentialTypeHelp=The credential type identifier for SD-JWT format credentials. This value is used in the vct claim of the issued credential. Required for SD-JWT format.
tokenJwsType=Token JWS Type
tokenJwsTypeHelp=The type value written into the typ header of the JWT. If empty, a format-specific default is used ("dc+sd-jwt" for SD-JWT VC and "vc+jwt" for JWT VC). Can be set to custom values if required by the wallet or system.
tokenJwsTypeFormatWarning=The configured Token JWS Type does not match the recommended value for the selected credential format. Recommended value: {{recommended}}.
visibleClaims=Visible Claims
visibleClaimsHelp=Comma-separated list of claims that are always disclosed in the SD-JWT body (e.g., "id,iat,nbf,exp,jti,given_name"). Defaults to "id,iat,nbf,exp,jti". Only applicable for SD-JWT format.
signingKeyId=Signing Key ID
signingKeyIdHelp=Optional. The ID of the realm key used to sign the credential. If not specified, the realm's active signing key of the algorithm specified by 'Credential Signing Algorithm' (if set) will be used automatically. If a specific key is selected here, the 'Credential Signing Algorithm' option will be disabled and automatically set to the key's algorithm.
useDefaultKey=Use default (realm's active signing key)
useDefaultAlg=Use default algorithm
# Workflows
workflows=Workflows
titleWorkflows=Workflows
workflowsExplain=Workflows empower administrators to automate the management of realm resources through time-based or event-based policies.
createWorkflow=Create workflow
workflowYAML=Workflow YAML
workflowYAMLHelp=The YAML representation of the workflow.
emptyWorkflows=No workflows
emptyWorkflowsInstructions=There are no workflows in this realm. Please create a workflow to get started.
emptyUserWorkflowsInstructions=There are no workflows scheduled for this user.
workflowCreated=The workflow has been created.
workflowCreateError=Could not create the workflow\: {{error}}
workflowDeleteConfirm=Delete workflow?
workflowDeleteConfirmDialog=This action will permanently delete the workflow. This cannot be undone.
workflowNameRequired=Workflow name is required.
workflowDeletedSuccess=The workflow has been deleted.
workflowDeleteError=Could not delete the workflow\: {{error}}
updateWorkflow=Update workflow
copyWorkflow=Copy workflow
workflowDetails=Workflow details
updateWorkflowDetails=Currently, workflows can not be edited except to change the name and enabled/disabled. You can copy the workflow and edit the copy.
copyWorkflowDetails=You are about to create a new workflow based on an existing one.
createWorkflowDetails=Create a new workflow by providing its JSON representation.
workflowEnabled=Workflow enabled
workflowDisabled=Workflow disabled
workflowUpdated=Workflow updated successfully
workflowUpdateError=Could not update the workflow\: {{error}}
step=Step
nextStep=Next step
scheduledAfter=Scheduled after
pending=Pending
completed=Completed
whichWorkflowsWillAppear=Which workflows will appear in this list?
whichWorkflowsWillAppearDetail=Workflows for this user with at least one pending step will appear. Some fully completed workflows may also appear if the scheduler has not yet cleaned them up.
# OID4VCI Protocol Mapper UI
claimDisplayName=Display Name
claimDisplayLocale=Locale
claimDisplayNamePlaceholder=e.g., Email Address
claimDisplayLocalePlaceholder=e.g., en, de, fr
addClaimDisplay=Add display entry
removeClaimDisplay=Remove display entry
noClaimDisplayEntries=No display entries. Display entries provide user-friendly claim names for different locales in wallet applications.
smtpConnectionTimeout=Connection timeout
smtpConnectionTimeoutHelp=The timeout in milliseconds for connecting to the SMTP server.
smtpSocketReadTimeout=Socket read timeout
smtpSocketReadTimeoutHelp=The timeout in milliseconds for reading from the SMTP server.
smtpSocketWriteTimeout=Socket write timeout
smtpSocketWriteTimeoutHelp=The timeout in milliseconds for writing to the SMTP server.
eventTypes.USER_SESSION_DELETED.name=User session deleted
eventTypes.USER_SESSION_DELETED.description=User session deleted
eventTypes.USER_SESSION_DELETED_ERROR.name=User session deleted error
eventTypes.USER_SESSION_DELETED_ERROR.description=User session deleted error
hideOnLoginWhenOrgNotResolved=Hide on login page when organization not resolved
hideOnLoginWhenOrgNotResolvedHelp=If enabled, the identity provider will be hidden on the login page when the organization cannot be resolved based on the user's email domain. Otherwise, the identity provider will be shown on the login page regardless of whether the organization is resolved or not. If 'Hide on login page' is also enabled, the identity provider will always be hidden on the login page.
showOnLoginForUnlinkedMembers=Show on login page for unlinked members
showOnLoginForUnlinkedMembersHelp=If enabled, this identity provider is shown to organization members even when they are already linked to another identity provider.
theme.keycloak.v2.admin.description=Cleaner and more modern, v2 supports automatic light/dark mode switching. (Default for Admin)

# Roles
role_admin=Admin
role_realm-admin=Realm Admin
role_create-realm=Create realm
role_create-client=Create client
role_delete-account=Delete account
role_view-realm=View realm
role_view-users=View users
role_view-applications=View applications
role_view-authorization=View authorization
role_view-groups=View groups
role_view-clients=View clients
role_view-events=View events
role_view-identity-providers=View identity providers
role_view-organizations=View organizations
role_view-consent=View consents
role_view-profile=View profile
role_manage-realm=Manage realm
role_manage-users=Manage users
role_manage-authorization=Manage authorization
role_manage-applications=Manage applications
role_manage-identity-providers=Manage identity providers
role_manage-organizations=Manage organizations
role_manage-clients=Manage clients
role_manage-events=Manage events
role_manage-account=Manage account
role_manage-account-links=Manage account links
role_manage-consent=Manage consents
role_query-realms=Query realms
role_query-clients=Query clients
role_query-groups=Query groups
role_query-users=Query users
role_query-organizations=Query organizations
role_default-roles=Default roles
role_impersonation=Impersonation
role_read-token=Read token
role_offline-access=Offline access
role_uma_authorization=Obtain permissions
scimApiEnabled=SCIM API
scimApiEnabledHelp=If enabled, exposes realm resources through an API based on the System for Cross-domain Identity Management (SCIM) specification, namely RFC7643 and RFC7644.
excludedDomains=Excluded domains
excludedDomainsHelp=A comma-separated list of domains to skip automatic redirection. You can use wildcard domains like `*.example.com` to exclude all subdomains of `example.com`. For instance, `*.example.com, example.com`.
clearInputField=Clear input field
