{
  "properties": {
    "spec": {
      "properties": {
        "client": {
          "properties": {
            "allowEcpFlow": {
              "description": "Allow ECP (Enhanced Client or Proxy) flow",
              "type": "boolean"
            },
            "appUrl": {
              "description": "URL to the application's homepage that is represented by this client",
              "type": "string"
            },
            "clientSignatureRequired": {
              "description": "Require client to sign SAML requests",
              "type": "boolean"
            },
            "createdTimestamp": {
              "description": "Timestamp when the client was created",
              "type": "integer"
            },
            "description": {
              "description": "Human readable description of the client",
              "type": "string"
            },
            "displayName": {
              "description": "Human readable name of the client",
              "type": "string"
            },
            "enabled": {
              "description": "Whether this client is enabled",
              "type": "boolean"
            },
            "forceNameIdFormat": {
              "description": "Force the specified Name ID format even if the client requests a different one",
              "type": "boolean"
            },
            "forcePostBinding": {
              "description": "Force POST binding for SAML responses",
              "type": "boolean"
            },
            "frontChannelLogout": {
              "description": "Use front-channel logout (browser redirect)",
              "type": "boolean"
            },
            "includeAuthnStatement": {
              "description": "Include AuthnStatement in the SAML response",
              "type": "boolean"
            },
            "nameIdFormat": {
              "description": "Name ID format to use for the subject",
              "enum": [
                "email",
                "persistent",
                "transient",
                "username"
              ],
              "type": "string"
            },
            "redirectUris": {
              "description": "URIs that the browser can redirect to after login",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "roles": {
              "description": "Roles associated with this client",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "signAssertions": {
              "description": "Sign SAML assertions",
              "type": "boolean"
            },
            "signDocuments": {
              "description": "Sign SAML documents on the server side",
              "type": "boolean"
            },
            "signatureAlgorithm": {
              "description": "Signature algorithm for signing SAML documents",
              "enum": [
                "DSA_SHA1",
                "RSA_SHA1",
                "RSA_SHA256",
                "RSA_SHA256_MGF1",
                "RSA_SHA512",
                "RSA_SHA512_MGF1"
              ],
              "type": "string"
            },
            "signatureCanonicalizationMethod": {
              "description": "Canonicalization method for XML signatures",
              "type": "string"
            },
            "signingCertificate": {
              "description": "X.509 certificate for signing (PEM format, without headers)",
              "type": "string"
            },
            "updatedTimestamp": {
              "description": "Timestamp when the client was last updated",
              "type": "integer"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "keycloakCRName": {
          "description": "The name of the Keycloak CR to reference, in the same namespace.",
          "type": "string",
          "x-kubernetes-validations": [
            {
              "message": "keycloakCrName is immutable",
              "rule": "self == oldSelf"
            }
          ]
        },
        "realm": {
          "description": "The realm of the Client",
          "type": "string",
          "x-kubernetes-validations": [
            {
              "message": "realm is immutable",
              "rule": "self == oldSelf"
            }
          ]
        }
      },
      "required": [
        "client",
        "keycloakCRName",
        "realm"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "properties": {
        "conditions": {
          "items": {
            "properties": {
              "lastTransitionTime": {
                "type": "string"
              },
              "message": {
                "type": "string"
              },
              "observedGeneration": {
                "type": "integer"
              },
              "status": {
                "type": "string"
              },
              "type": {
                "type": "string"
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "hash": {
          "type": "string"
        },
        "observedGeneration": {
          "type": "integer"
        },
        "uuid": {
          "type": "string"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "required": [
    "spec"
  ],
  "type": "object"
}