How do I create a SAML public client?

[jonathanmanton]

When creating a SAML client via the Keycloak web UI (KC 24.6.7), by default it creates the client with publicClient = true. This is an attribute at the root of the provider configuration.

There is no option (that I could find) to mimic this behavior using the keycloak terraform provider.

I tried using:

extra_config = {
    "publicClient" = "true"
  }

However, that sets the value attributes.publicClient, not the value at the root level of the object. E.g., when I export the resultant saml client, I see something like this:

...
  "publicClient": false,
  "frontchannelLogout": true,
  "protocol": "saml",
  "attributes": {
    "saml.assertion.signature": "false",
    "publicClient": "true",
...

How do I create a SAML client using the keycloak provider that does not require a client secret to authenticate?

[jonathanmanton]

Alternately, if I cannot create a public client, how can I get access to the client secret for the just-created SAML client? I need one or the other for the client to be useful when configuring other applications for SSO using SAML.