{
  "realm": "demo",
  "enabled": true,
  "sslRequired": "none",
  "registrationAllowed": false,
  "roles": {
    "realm": [
      { "name": "user", "description": "Can read reports" },
      { "name": "admin", "description": "Can manage users through the admin API" }
    ],
    "client": {
      "spring-api": [
        { "name": "reports-write", "description": "Client role: can export reports" }
      ]
    }
  },
  "clients": [
    {
      "clientId": "spring-api",
      "name": "Spring resource server",
      "enabled": true,
      "bearerOnly": true
    },
    {
      "clientId": "demo-cli",
      "name": "Public client WITHOUT an audience mapper",
      "enabled": true,
      "publicClient": true,
      "standardFlowEnabled": false,
      "directAccessGrantsEnabled": true
    },
    {
      "clientId": "demo-cli-aud",
      "name": "Public client WITH an audience mapper for spring-api",
      "enabled": true,
      "publicClient": true,
      "standardFlowEnabled": false,
      "directAccessGrantsEnabled": true,
      "protocolMappers": [
        {
          "name": "spring-api-audience",
          "protocol": "openid-connect",
          "protocolMapper": "oidc-audience-mapper",
          "config": {
            "included.client.audience": "spring-api",
            "id.token.claim": "false",
            "access.token.claim": "true"
          }
        }
      ]
    },
    {
      "clientId": "admin-svc",
      "name": "Service account used by the admin client",
      "enabled": true,
      "publicClient": false,
      "secret": "admin-svc-demo-secret",
      "standardFlowEnabled": false,
      "directAccessGrantsEnabled": false,
      "serviceAccountsEnabled": true
    }
  ],
  "users": [
    {
      "username": "alice",
      "enabled": true,
      "email": "alice@example.com",
      "emailVerified": true,
      "firstName": "Alice",
      "lastName": "Anderson",
      "credentials": [ { "type": "password", "value": "password", "temporary": false } ],
      "realmRoles": [ "user" ]
    },
    {
      "username": "bob",
      "enabled": true,
      "email": "bob@example.com",
      "emailVerified": true,
      "firstName": "Bob",
      "lastName": "Brown",
      "credentials": [ { "type": "password", "value": "password", "temporary": false } ],
      "realmRoles": [ "user", "admin" ],
      "clientRoles": { "spring-api": [ "reports-write" ] }
    },
    {
      "username": "service-account-admin-svc",
      "enabled": true,
      "serviceAccountClientId": "admin-svc",
      "clientRoles": { "realm-management": [ "manage-users", "view-users", "view-realm" ] }
    }
  ]
}