From 4d576fa2afc6af2f56527d82ee1a48875b4fe8b9 Mon Sep 17 00:00:00 2001 From: keycloak-bot Date: Tue, 5 Mar 2024 08:55:02 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20main=20from=20=20@=2041b4df060?= =?UTF-8?q?b0365ca8e16bf5174cb5bf2c9f49534=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 2024/03/keycloak-2401-released.html | 113 + archive/documentation-24.0.html | 16 +- archive/downloads-24.0.1.html | 278 + blog-archive.html | 5 + blog.html | 24 +- documentation.html | 6 +- downloads-archive.html | 1 + downloads.html | 38 +- getting-started/getting-started-docker.html | 2 +- getting-started/getting-started-podman.html | 2 +- getting-started/getting-started-zip.html | 6 +- index.html | 8 +- operator/installation.html | 6 +- operator/realm-import.html | 2 +- rss.xml | 24167 +----------------- 15 files changed, 1627 insertions(+), 23047 deletions(-) create mode 100644 2024/03/keycloak-2401-released.html create mode 100644 archive/downloads-24.0.1.html diff --git a/2024/03/keycloak-2401-released.html b/2024/03/keycloak-2401-released.html new file mode 100644 index 000000000000..fc4f6456414c --- /dev/null +++ b/2024/03/keycloak-2401-released.html @@ -0,0 +1,113 @@ + + + + + + Keycloak 24.0.1 released - Keycloak + + + + + + + + + + + + + + + + + + + + + +
+ +
+ + +
+

Keycloak 24.0.1 released

+

March 05 2024

+ + +

To download the release go to Keycloak downloads.

+ +

Highlights

+
+

Operator deploys nightly build instead of 24.0.0

+
+

Due to an issue in the release process when deploying Keycloak using the Operator it installed the nightly container +instead of 24.0.0.

+
+
+

As a quick fix to the issue, the 24.0.0 container was tagged with nightly, and the nightly releases was temporarily +disabled.

+
+
+

If you installed or upgraded to 24.0.0 using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:

+
+
+
+
SELECT * from migration_model WHERE version = '999.0.0';
+
+
+
+

If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:

+
+
+
+
UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';
+
+
+
+

Upgrading

+

Before upgrading refer to the migration guide for a complete list of changes.

+ +
+ + +
+
+

Keycloak is a Cloud Native Computing Foundation incubation project

+
+ Cloud Native Computing Foundation +
+

© Keycloak Authors 2023. © 2023 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page.

+
+
+ + + diff --git a/archive/documentation-24.0.html b/archive/documentation-24.0.html index adefe971efe9..f649d0ec53b3 100644 --- a/archive/documentation-24.0.html +++ b/archive/documentation-24.0.html @@ -74,7 +74,7 @@

Guides

- + Release Notes @@ -113,7 +113,7 @@

Guides

- + Securing Applications and Services @@ -123,7 +123,7 @@

Guides

- + Server Administration @@ -133,7 +133,7 @@

Guides

- + Server Developer @@ -143,7 +143,7 @@

Guides

- + Authorization Services @@ -153,7 +153,7 @@

Guides

- + Upgrading @@ -170,7 +170,7 @@

API Documentation

- + JavaDoc @@ -180,7 +180,7 @@

API Documentation

- + Administration REST API diff --git a/archive/downloads-24.0.1.html b/archive/downloads-24.0.1.html new file mode 100644 index 000000000000..c6034d24df95 --- /dev/null +++ b/archive/downloads-24.0.1.html @@ -0,0 +1,278 @@ + + + + + + Downloads 24.0.1 - Keycloak + + + + + + + + + + + + + + + + + + + + + +
+ +
+ + +
+

Downloads 24.0.1

+ + + + +

Server

+ + + + + + + + + + + + + + + + + + + +
KeycloakDistribution powered by Quarkus + + + + ZIP + +(sha1) + + + + + TAR.GZ + +(sha1) + +
Container imageFor Docker, Podman, Kubernetes and OpenShift + + + Quay + +
OperatorFor Kubernetes and OpenShift + + + OperatorHub + +
+ +

Quickstarts

+ + + + + + + + +
Quickstarts distribution + + + + + GitHub + + + + + + ZIP + + +
+ + +

Client Adapters

+ +
+ + +
+
+ + + + + + + + + + + + + + +
JavaScript + + + + + +
+ + + NPM + + + + + + ZIP + +(sha1) + + + + + TAR.GZ + +(sha1) + +
+
Node.js [DEPRECATED] + + + + + +
+ + NPM + +
+
Tomcat [DEPRECATED] + + + + + +
8, 9 + + + + ZIP + +(sha1) + + + + + TAR.GZ + +(sha1) + +
+
+
+ +
+ + + + + + + +
Tomcat [DEPRECATED] + + + + + +
8, 9 + + + + ZIP + +(sha1) + + + + + TAR.GZ + +(sha1) + +
+
+
+
+
+
+ +
+
+

Keycloak is a Cloud Native Computing Foundation incubation project

+
+ Cloud Native Computing Foundation +
+

© Keycloak Authors 2023. © 2023 The Linux Foundation. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page.

+
+
+ + + diff --git a/blog-archive.html b/blog-archive.html index cad6a3170ac6..96bcfd453dd5 100644 --- a/blog-archive.html +++ b/blog-archive.html @@ -71,6 +71,11 @@

2024

March

+ + + diff --git a/blog.html b/blog.html index 6715c2c61abc..1856f5884a3a 100644 --- a/blog.html +++ b/blog.html @@ -59,6 +59,18 @@
+
+
+
+

Keycloak 24.0.1 released

+ + 05 March 2024 + + + +
+
+
@@ -143,18 +155,6 @@

Keycloak 23.0.3 released

-
-
-
-

Keycloak 23.0.2 released

- - 14 December 2023 - - - -
-
-
diff --git a/documentation.html b/documentation.html index 0a433855725f..e9ef1e7c94f9 100644 --- a/documentation.html +++ b/documentation.html @@ -57,7 +57,7 @@
-

Documentation 24.0.0

+

Documentation 24.0.1

Guides

@@ -162,7 +162,7 @@

API Documentation

- + JavaDoc @@ -172,7 +172,7 @@

API Documentation

- + Administration REST API diff --git a/downloads-archive.html b/downloads-archive.html index b0466fde30d9..d47d851c962e 100644 --- a/downloads-archive.html +++ b/downloads-archive.html @@ -67,6 +67,7 @@

Downloads archive

    +
  • 24.0.1
  • 24.0.0
  • 23.0.7
  • 23.0.6
    • diff --git a/downloads.html b/downloads.html index 844f557a1471..fab68aa55622 100644 --- a/downloads.html +++ b/downloads.html @@ -57,7 +57,7 @@
    -

    Downloads 24.0.0

    +

    Downloads 24.0.1

    For a list of community maintained extensions check out the Extensions page. @@ -73,18 +73,18 @@

    Server

    Distribution powered by Quarkus - + ZIP -(sha1) +(sha1) - + TAR.GZ -(sha1) +(sha1) @@ -156,23 +156,23 @@

    Client Adapters

    - + NPM - + ZIP -(sha1) +(sha1) - + TAR.GZ -(sha1) +(sha1) @@ -186,7 +186,7 @@

    Client Adapters

    - + NPM @@ -202,18 +202,18 @@

    Client Adapters

    8, 9 - + ZIP -(sha1) +(sha1) - + TAR.GZ -(sha1) +(sha1) @@ -235,18 +235,18 @@

    Client Adapters

    8, 9 - + ZIP -(sha1) +(sha1) - + TAR.GZ -(sha1) +(sha1) diff --git a/getting-started/getting-started-docker.html b/getting-started/getting-started-docker.html index 04795247769c..aa92f2b31dd9 100644 --- a/getting-started/getting-started-docker.html +++ b/getting-started/getting-started-docker.html @@ -91,7 +91,7 @@

    Start Keycloak

    -
    docker run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:24.0.0 start-dev
    +
    docker run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:24.0.1 start-dev
    diff --git a/getting-started/getting-started-podman.html b/getting-started/getting-started-podman.html index 2b1ebe105410..e4ba523ec0fe 100644 --- a/getting-started/getting-started-podman.html +++ b/getting-started/getting-started-podman.html @@ -91,7 +91,7 @@

    Start Keycloak

    -
    podman run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:24.0.0 start-dev
    +
    podman run -p 8080:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin quay.io/keycloak/keycloak:24.0.1 start-dev
    diff --git a/getting-started/getting-started-zip.html b/getting-started/getting-started-zip.html index 8953145bd08e..7e0cad019033 100644 --- a/getting-started/getting-started-zip.html +++ b/getting-started/getting-started-zip.html @@ -87,11 +87,11 @@

    Before you start

    Download Keycloak

    -

    Download and extract keycloak-24.0.0.zip +

    Download and extract keycloak-24.0.1.zip from the Keycloak website.

    -

    After extracting this file, you should have a directory that is named keycloak-24.0.0.

    +

    After extracting this file, you should have a directory that is named keycloak-24.0.1.

    @@ -101,7 +101,7 @@

    Start Keycloak

    1. -

      From a terminal, open the keycloak-24.0.0 directory.

      +

      From a terminal, open the keycloak-24.0.1 directory.

    2. Enter the following command:

      diff --git a/index.html b/index.html index 6c10a6b942dc..5d0784dc8318 100644 --- a/index.html +++ b/index.html @@ -73,7 +73,7 @@

      Open Source Identity and Access Management

      Download
    - Latest release 24.0.0 + Latest release 24.0.1
@@ -88,13 +88,13 @@

Open Source Identity and Access Management

News
- 04 Mar Keycloak 24.0.0 released + 05 Mar Keycloak 24.0.1 released
- 22 Feb Keycloak 23.0.7 released + 04 Mar Keycloak 24.0.0 released
- 02 Feb Keycloak 23.0.6 released + 22 Feb Keycloak 23.0.7 released
diff --git a/operator/installation.html b/operator/installation.html index a21c833d637e..9bf5a879cd54 100644 --- a/operator/installation.html +++ b/operator/installation.html @@ -152,8 +152,8 @@

Install

Install the CRDs by entering the following commands:

-
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.0/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
-kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.0/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
+
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.1/kubernetes/keycloaks.k8s.keycloak.org-v1.yml
+kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.1/kubernetes/keycloakrealmimports.k8s.keycloak.org-v1.yml
@@ -161,7 +161,7 @@

Install

Install the Keycloak Operator deployment by entering the following command:

-
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.0/kubernetes/kubernetes.yml
+
kubectl apply -f https://raw.githubusercontent.com/keycloak/keycloak-k8s-resources/24.0.1/kubernetes/kubernetes.yml
diff --git a/operator/realm-import.html b/operator/realm-import.html index 285dd356ff7f..72e25ab6a643 100644 --- a/operator/realm-import.html +++ b/operator/realm-import.html @@ -121,7 +121,7 @@

Creating a Realm Import Custom

This CR should be created in the same namespace as the Keycloak Deployment CR, defined in the field keycloakCRName. -The realm field accepts a full RealmRepresentation.

+The realm field accepts a full RealmRepresentation.

The recommended way to obtain a RealmRepresentation is by leveraging the export functionality Importing and Exporting Realms.

diff --git a/rss.xml b/rss.xml index 4a7b966e7a18..f2ef3870dc31 100644 --- a/rss.xml +++ b/rss.xml @@ -9,23518 +9,1701 @@ en-us Keycloak/SSO/Identity and Access Management - Keycloak 24.0.0 released - https://www.keycloak.org/2024/03/keycloak-2400-released + Keycloak 24.0.1 released + https://www.keycloak.org/2024/03/keycloak-2401-released <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> <h2>Highlights</h2> <div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> <div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> <div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> <div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/03/keycloak-2401-released + Tue, 5 Mar 2024 00:00:00 GMT + Keycloak Release + + + + Keycloak 24.0.0 released + https://www.keycloak.org/2024/03/keycloak-2400-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> <div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> <div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> <div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="imageblock"> +<div class="listingblock"> <div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> </div> <div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="imageblock"> +<div class="listingblock"> <div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/03/keycloak-2400-released + Mon, 4 Mar 2024 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.7 released + https://www.keycloak.org/2024/02/keycloak-2307-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> <div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> <div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> <div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> <div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> </div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/02/keycloak-2307-released + Thu, 22 Feb 2024 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.6 released + https://www.keycloak.org/2024/02/keycloak-2306-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> <div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> <div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> <div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> </div> </div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/02/keycloak-2306-released + Fri, 2 Feb 2024 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.5 released + https://www.keycloak.org/2024/01/keycloak-2305-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> <div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> <div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> <div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/01/keycloak-2305-released + Mon, 29 Jan 2024 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.4 released + https://www.keycloak.org/2024/01/keycloak-2304-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> <div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> <div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> <div class="listingblock"> <div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> <div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> </div> </div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2024/01/keycloak-2304-released + Mon, 8 Jan 2024 00:00:00 GMT + Keycloak Release + + + + Recover from site failures with a Multi-Site Setup + https://www.keycloak.org/2023/12/recover-site-failures + <div class="paragraph"> +<p>For a Customer Identity and Access Management (CIAM) system, high availability is essential as it is a single point for all systems where customers log in. +For Keycloak 23, there is a new and updated High Availability guide describing multi-site setups. +With detailed instructions and blueprints targeting cloud infrastructure, this is documented, tested, and ready to be tried out.</p> </div> <div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> +<p>Read on to find out what is new, and take a peek behind the scenes how this setup has been evaluated, tested and improved. +And finally, we are providing an outlook when this will no longer be a preview feature.</p> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> +<div class="sect1"> +<h2 id="_improved_documentation_and_new_blueprints">Improved documentation and new blueprints</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> +<p>The recent updates to Keycloak&#8217;s multi-site setup mark a significant milestone. +Keycloak 23 includes an <a href="https://www.keycloak.org/high-availability/introduction">opinionated guide</a> on setting up Keycloak in a multi-site configuration including blueprints for a cloud setup.</p> </div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<div class="imageblock"> +<div class="content"> +<a class="image" href="https://www.keycloak.org/high-availability/concepts-active-passive-sync"><img src="https://www.keycloak.org/resources/images/guides/high-availability/active-passive-sync.dio.svg" alt="active passive sync.dio"></a> </div> </div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> <div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2024/03/keycloak-2400-released - Mon, 4 Mar 2024 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.7 released - https://www.keycloak.org/2024/02/keycloak-2307-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2024/02/keycloak-2307-released - Thu, 22 Feb 2024 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.6 released - https://www.keycloak.org/2024/02/keycloak-2306-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2024/02/keycloak-2306-released - Fri, 2 Feb 2024 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.5 released - https://www.keycloak.org/2024/01/keycloak-2305-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2024/01/keycloak-2305-released - Mon, 29 Jan 2024 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.4 released - https://www.keycloak.org/2024/01/keycloak-2304-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2024/01/keycloak-2304-released - Mon, 8 Jan 2024 00:00:00 GMT - Keycloak Release - - - - Recover from site failures with a Multi-Site Setup - https://www.keycloak.org/2023/12/recover-site-failures - <div class="paragraph"> -<p>For a Customer Identity and Access Management (CIAM) system, high availability is essential as it is a single point for all systems where customers log in. -For Keycloak 23, there is a new and updated High Availability guide describing multi-site setups. -With detailed instructions and blueprints targeting cloud infrastructure, this is documented, tested, and ready to be tried out.</p> -</div> -<div class="paragraph"> -<p>Read on to find out what is new, and take a peek behind the scenes how this setup has been evaluated, tested and improved. -And finally, we are providing an outlook when this will no longer be a preview feature.</p> -</div> -<div class="sect1"> -<h2 id="_improved_documentation_and_new_blueprints">Improved documentation and new blueprints</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>The recent updates to Keycloak&#8217;s multi-site setup mark a significant milestone. -Keycloak 23 includes an <a href="https://www.keycloak.org/high-availability/introduction">opinionated guide</a> on setting up Keycloak in a multi-site configuration including blueprints for a cloud setup.</p> -</div> -<div class="imageblock"> -<div class="content"> -<a class="image" href="https://www.keycloak.org/high-availability/concepts-active-passive-sync"><img src="https://www.keycloak.org/resources/images/guides/high-availability/active-passive-sync.dio.svg" alt="active passive sync.dio"></a> -</div> -</div> -<div class="paragraph"> -<p>The high-level topics of this documentation are:</p> -</div> -<div class="dlist"> -<dl> -<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_concept_and_building_block_overview">Concept and building block overview</a></dt> -<dd> -<p>These guides include step-by-step instructions to bring up different components of the Keycloak multi-site architecture such as:</p> -<div class="ulist"> -<ul> -<li> -<p>What does an active-passive setup with Keycloak architecture look like?</p> -</li> -<li> -<p>How to use an external database?</p> -</li> -<li> -<p>How to tune the resources for each of these architectural components?</p> -</li> -</ul> -</div> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_blueprints_for_building_blocks">Blueprints for building blocks</a></dt> -<dd> -<p>A series of guides around how to deploy Keycloak in various configurations on Amazon Web Service.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_operational_procedures">Operational procedures</a></dt> -<dd> -<p>These guides include detailed operational procedures, ensuring that users can set up and operate their multi-site Keycloak instances efficiently.</p> -</dd> -</dl> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_validation_of_the_multi_site_setup">Validation of the multi-site setup</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>Before we published the guides above, we worked on the tooling that allows us both experimenting and getting reproducible results for performance, scalability and chaos testing our solution.</p> -</div> -<div class="paragraph"> -<p>With these tools, we tested first a single-site setup, and once that worked sufficiently well, also a multi-site setup.</p> -</div> -<div class="paragraph"> -<p>All these tools are available as open source, and we invite you to review them to give us feedback, and use them in your environment to run your own performance benchmark and regression tests:</p> -</div> -<div class="dlist"> -<dl> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/dataset-guide/latest/">Dataset Provider</a></dt> -<dd> -<p>Install this into a Keycloak server in a test environment, and create as many users, clients, groups, etc. as you need to run your performance benchmark. -Keycloak caches a lot of information in its internal caches, and so does the database, so you will be able to spot some problems only when you have the right amount of data in your database.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/benchmark-guide/latest/">Benchmark</a></dt> -<dd> -<p>This contains ready-to-be used scenarios for authentication flows and for Keycloak&#8217;s admin REST endpoints. -If it does not fit your needs yet, use it as a library to create your own Gatling scenarios based on existing and custom steps. -These tests are deployed as a JAR and a shell script wrapper, so you will only need to install Java on your load runners and you are ready to go.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/benchmark-guide/latest/run/running-benchmark-ansible">Dedicated EC2 load drivers</a></dt> -<dd> -<p>Use these Ansible playbooks to spin up a set of EC2 instances to drive load against a Keycloak test installation, and aggregate the results.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/prerequisite/prerequisite-rosa">Automated OpenShift installation on AWS</a></dt> -<dd> -<p>Based on Red Hat OpenShift Service on AWS (ROSA), use the scripts to provision an instance with monitoring, logging and useful Operators preconfigured, ready to deploy Keycloak.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/storage/aurora-regional-postgres">Automated Aurora installation</a></dt> -<dd> -<p>Set up an Aurora in different variants regional or global, and connect it to a ROSA environment.</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/openshift/">Opinionated Keycloak deployment for Minikube or OpenShift</a></dt> -<dd> -<p>This deploys Keycloak with additional monitoring and debugging tools so we can look at metrics, logs and traces as needed</p> -</dd> -<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/openshift/installation-route53-loadbalancer">Scripted AWS Route 53 load balancer</a></dt> -<dd> -<p>Set up Route 53 for an active-passive setup to distribute the load to two Keycloak deployments in different OpenShift clusters</p> -</dd> -<dt class="hdlist1"><a href="https://github.com/keycloak/keycloak-benchmark/blob/main/.github/workflows/rosa-multi-az-cluster-create.yml">Scripted Multi-AZ deployment</a></dt> -<dd> -<p>Every weekday we create a new Multi-AZ setup from scratch using GitHub actions, a performance testsuite, and record the results. -This way we catch functional and performance regressions as they occur.</p> -</dd> -</dl> -</div> -<div class="paragraph"> -<p>Thank you to everyone in the community who has already tried out these tools, found bugs and submitted ideas for improvements!</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_keycloak_got_better_for_everyone">Keycloak got better for everyone</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>When using the tools listed above, we were able to reproduce several situations where Keycloak needed to improve. -Here are of the improvements which are available in Keycloak 23 for both single-site and multi-site setups:</p> -</div> -<div class="dlist"> -<dl> -<dt class="hdlist1">Non-Blocking liveness probe</dt> -<dd> -<p>When running Keycloak under a high load, requests might queue up in a Keycloak instance. -The more requests queue up, the longer it takes to reply to the requests. -In previous versions also the requests to the liveness probe (<code>/health/live</code>) were queued, and the probe eventually timed out, and then Kubernetes restarted the Pod. -In the latest version of Keycloak, the probe is <a href="https://github.com/keycloak/keycloak/issues/22109">re-implemented to be non-blocking</a>, so it will not queue, and therefore will not time out and the Pod is not restarted under a high load.</p> -</dd> -<dt class="hdlist1">Load Shedding</dt> -<dd> -<p>When requests are queued as described above, the caller will not get a response in time, and the Pod might eventually run out of resources like memory or network connections. -The recommended recipe is to drop requests early when an instance will not be able to serve the requests in time, which is called load shedding. -Keycloak 23 now supports the <a href="https://www.keycloak.org/server/configuration-production">new option <code>http-max-queued-requests</code></a> that can limit the number of concurrent blocking requests. -When the number is exceeded, Keycloak immediately returns the response <code>503 Server not Available</code>. -This has two benefits: The caller receives an immediate response and can retry later, and resources are freed on the server side immediately.</p> -</dd> -<dt class="hdlist1">Prevented cache stampede for realms and clients</dt> -<dd> -<p>When a new Keycloak instance starts or restarts, its caches are empty. -If under high load parallel requests arrive for the same realm or the same client on a node of Keycloak, previous versions of Keycloak loaded the data from the database in each parallel request. -This caused a spike in database connection usage and an initial response delay. -The same happens when a cache or realm entry in the cache is evicted, for example, because it was modified. -The latest version of Keycloak prevents this so that each Keycloak instance will fetch the data from the database once, and all other parallel requests then use this data without querying the database again (see <a href="https://github.com/keycloak/keycloak/issues/21521">#21521</a> and <a href="https://github.com/keycloak/keycloak/issues/22988">#22988</a>, <a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a>).</p> -</dd> -<dt class="hdlist1">Align the number of JGroup threads with the number of Quarkus threads</dt> -<dd> -<p>The more Keycloak instances run in a cluster, and the more requests are processed in parallel, the higher is the load on the JGroups thread pool. -The JGroups thread pool ensures smooth communication for the embedded Infinispan of Keycloak, and could lead to timeouts on the internal Infinispan communications if its capacity is exceeded. -The high-availability docs now contain documentation on <a href="https://www.keycloak.org/high-availability/concepts-threads">how to set the Quarkus thread pool to not exceed the JGroup thread pool</a>.</p> -</dd> -<dt class="hdlist1">Improved Infinispan Metrics</dt> -<dd> -<p>The embedded Infinispan provides improved metrics that allow you to monitor your cluster. -The metrics exposed by the Keycloak&#8217;s metrics endpoint now contain only Infinispan metrics for the current node, so they will not block if another Pod is currently starting up or shutting down (<a href="https://issues.redhat.com/browse/ISPN-15042">ISPN-15042</a> and <a href="https://issues.redhat.com/browse/ISPN-15072">ISPN-15072</a>). -This way you have better visibility of your cluster during those critical moments. -The metrics can now expose the cache names as labels, so they can be plotted simpler in dashboards by adding a <code>&lt;metrics names-as-tags="true" /&gt;</code> to the Infinispan XML configuration. -Additional metrics are available for the latencies between sites.</p> -</dd> -<dt class="hdlist1">Reliable Infinispan operations</dt> -<dd> -<p>We tested Infinispan and its communication layer JGroups thoroughly, and we were able to fix situations where a state transfer stalled (<a href="https://issues.redhat.com/browse/ISPN-14982">ISPN-14982</a>), or an initial state transfer failed. -The Gossip router used in the multi-site setup now works even in situations where a load balancer has multiple IP addresses (<a href="https://issues.redhat.com/browse/JGRP-2722">JGRP-2722</a>, <a href="https://issues.redhat.com/browse/JGRP-2721">JGRP-2721</a>, <a href="https://github.com/infinispan/infinispan-operator/issues/1857">infinispan-operator#1857</a>, and <a href="https://github.com/infinispan/infinispan-operator/issues/1856">infinispan-operator#1856</a>).</p> -</dd> -</dl> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_can_the_blueprints_or_scripts_be_used_in_production">Can the blueprints or scripts be used in production?</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>As part of the testing we did, we optimized Keycloak and those optimizations are built into Keycloak. -They are available without the need for additional configuration except for the JGroup thread pool configuration. -While the configuration of Keycloak on Kubernetes might match a production environment quite closely, we expect the database, network, load balancer and security hardening to be different in every organization, so you will need to adapt it to your needs.</p> -</div> -<div class="paragraph"> -<p>This is why we chose to document the blueprints as text, so you can learn about the choices we made and why different aspects are configured in one setup, while others are at their default settings.</p> -</div> -<div class="paragraph"> -<p>The scripts we use for the automated setup in the Keycloak Benchmark project focus on high availability and mix this with configurations that are simple to debug and analyze from an engineering perspective. -A production-ready setup would not have that functionality, so we do not recommend using the scripts as is. -Still, they can serve as a starting point for your own automation.</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_read_the_guides_and_give_it_a_try">Read the guides and give it a try!</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>At the moment, we are running the final tests for an active/passive setup and work toward automating more tests. -We are also looking for feedback from the community in this <a href="https://github.com/keycloak/keycloak/discussions/25269">GitHub discussion on multi-site setups</a>: Do you like what you see here? -Is something missing? -Your feedback is essential!</p> -</div> -<div class="paragraph"> -<p>Once our tests are complete, and we receive feedback from the community, we plan to make it a fully supported feature. -This is a huge opportunity for the community to engage with this setup, try it in your environment, and share your findings. -Let&#8217;s build a stronger and more resilient Keycloak together!</p> -</div> -</div> -</div> - https://www.keycloak.org/2023/12/recover-site-failures - Mon, 18 Dec 2023 00:00:00 GMT - - Alexander Schwartz, Kamesh Akella - - - Keycloak 23.0.3 released - https://www.keycloak.org/2023/12/keycloak-2303-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/12/keycloak-2303-released - Fri, 15 Dec 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.2 released - https://www.keycloak.org/2023/12/keycloak-2302-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/12/keycloak-2302-released - Thu, 14 Dec 2023 00:00:00 GMT - Keycloak Release - - - - Join Keycloak Developer Day: A Celebration of Innovation and Community! - https://www.keycloak.org/2023/12/keycloak-dev-day-24 - <div class="paragraph"> -<p>Are you passionate about Keycloak and eager to dive deeper into this incredible Open Source IAM solution? -Then don’t miss <a href="https://keycloak-day.dev">Keycloak Developer Day</a> – a one-day, community-driven conference in Frankfurt/Main Germany in February 2024, dedicated to Keycloak and its vibrant community.</p> -</div> -<div class="sect1"> -<h2 id="_community_event_to_celebrate_keycloak">Community Event to celebrate Keycloak</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p><a href="https://github.com/dasniko">Niko</a> and <a href="https://github.com/srose">I (Sebastian)</a> have been active in the Keycloak community for years and have been using Keycloak in many customer projects. -We co-organize the Java User Group Darmstadt, and participate in community events like the JavaLand conference. -Now we want to take the next step: Create a special event to celebrate and explore the vast possibilities of Keycloak. -We&#8217;re thrilled to invite you to be part of this exciting first occasion, the Keycloak Developer Day 2024!</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_tailored_for_users_of_keycloak">Tailored for users of Keycloak</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>We&#8217;re calling everyone using Keycloak in their day-to-day work – whether you&#8217;re tackling operational challenges, brainstorming innovative solutions to unique use-cases, or just curious about the future of IAM – to join us.</p> -</div> -<div class="paragraph"> -<p>Expect a day filled with insightful talks, hands-on workshops, and plenty of opportunities to network with fellow Keycloak enthusiasts and Keycloak maintainers. -The feature set of Keycloak is as vast as it is impressive, promising a rich array of topics to explore.</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_book_your_ticket_online">Book your ticket online</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>Don&#8217;t miss this unique opportunity to connect, share, and grow with the Keycloak community. -Book your ticket today at <a href="https://keycloak-day.dev">keycloak-day.dev</a> and join us in celebrating Keycloak!</p> -</div> -</div> -</div> - https://www.keycloak.org/2023/12/keycloak-dev-day-24 - Mon, 11 Dec 2023 00:00:00 GMT - - Sebastian Rose - - - Keycloak 23.0.1 released - https://www.keycloak.org/2023/11/keycloak-2301-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/11/keycloak-2301-released - Wed, 29 Nov 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 23.0.0 released - https://www.keycloak.org/2023/11/keycloak-2300-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Highlights</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties </li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API </li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support </li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange </li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header </li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr </li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide </li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires </li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues </li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options </li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/11/keycloak-2300-released - Thu, 23 Nov 2023 00:00:00 GMT - Keycloak Release - - - - Developer Certificate of Origin - https://www.keycloak.org/2023/10/dco - <div class="paragraph"> -<p>For any Open Source project, it is important that any contributions contain code that can legally be contributed to the -project, and that the project has the right to distribute it under its license. There are many ways to achieve this, -where two popular approaches are Developer Certificate of Origin (DCO) and Contributor License Agreement (CLA).</p> -</div> -<div class="paragraph"> -<p><a href="https://developercertificate.org/">Developer Certificate of Origin (DCO)</a> is the most lightweight approach, which -requires contributors to sign-off on individual commits that are part of a contribution. This is easily done by using -the <code>--signoff</code> (<code>-s</code>) option when creating a commit. For example:</p> -</div> -<div class="literalblock"> -<div class="content"> -<pre>git commit -s -m "Description of the commit"</pre> -</div> -</div> -<div class="paragraph"> -<p>This adds a <code>Signed-off-by</code> statement at the end of the commit, where the contributor certifies they are following the -agreement laid out in the <a href="https://developercertificate.org/">Developer Certificate of Origin (DCO)</a>.</p> -</div> -<div class="paragraph"> -<p>Contributor License Agreement (CLA), on the other hand, is a more complicated approach. As part of CLA, any contributors -are required to sign an upfront agreement with the project before making any contributions. This provides a higher -barrier for contributors, and also a higher cost for the Open Source Project as it has to maintain a list of approved -contributors with a corresponding maintained archive of agreements.</p> -</div> -<div class="paragraph"> -<p>For Keycloak we decided to go with DCO as we believe it is much simpler both for contributors as well as maintainers.</p> -</div> -<div class="paragraph"> -<p>If you are interested in learning more about CLA vs DCO, -<a href="https://opensource.com/article/18/3/cla-vs-dco-whats-difference">opensource.com has an excellent article on the subject</a>.</p> -</div> - https://www.keycloak.org/2023/10/dco - Tue, 31 Oct 2023 00:00:00 GMT - - Stian Thorgersen - - - Keycloak 22.0.5 released - https://www.keycloak.org/2023/10/keycloak-2205-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/10/keycloak-2205-released - Tue, 24 Oct 2023 00:00:00 GMT - Keycloak Release - - - - Announcement: Discontinuation of Keycloak's Map Store - https://www.keycloak.org/2023/10/map-store-removal - <div class="paragraph"> -<p>Dear Keycloak community,</p> -</div> -<div class="paragraph"> -<p>For the past two years, the Keycloak store team has been working on a <a href="https://github.com/keycloak/keycloak-community/blob/main/design/keycloak.x/storage.md">replacement for the storage layer</a>, which became known as the Map Store. Despite the successful development of many features, such as a new JPA storage layer with some no downtime capabilities, a new Hot Rod storage layer, flexible configuration, among others, the amount of work remaining for the store to be fully operational and supported is still quite significant. There is still a lot of uncertainty and risk involved in getting to the point where the store is production ready and able to provide enough value for users to migrate to it.</p> -</div> -<div class="paragraph"> -<p>To give more context, the new Map Store still lacks support for databases other than PostgreSQL and CockroachDB, a caching layer, implementation of the tree store that ties all the stores together, a migration strategy to Map Store, thorough testing, among other things. Each of these items is complex, require a significant amount of development and testing time, and carry risks of their own.</p> -</div> -<div class="paragraph"> -<p>This situation, combined with the need to address existing issues and demands in the storage area now rather than in a somewhat distant future, led us to the tough decision to stop any development in the Map Store. Instead the team will focus on improving the capabilities of the current store and deliver these improvements in smaller chunks and quicker iterations. One of these improvements is to fully support a high availability setup for Keycloak spanning multiple data centers and regions, also known as cross-DC support. While this has been a preview feature in the past, this should now become fully supported in a future release and include guides on how to configure different parts in a cloud environment.</p> -</div> -<div class="paragraph"> -<p>The experience we gained from the Map Store development won’t be wasted though, as the ideas and experiments that worked well in the Map Store are all natural candidates for enhancements in the storage area. Still the Map Store will be entirely removed from the main codebase. Having two different storage implementations is greatly complicating the maintenance process and also making it more difficult for users and other teams to work with the store as they need to understand how to operate on two very different implementations.</p> -</div> -<div class="sect1"> -<h2 id="_whats_next">What&#8217;s next?</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>For the time being, the Map Store will be available in a separate branch, yet to be created. It will exist mainly to provide us with a way to fetch bits and pieces that can be valuable to the current store. Then, you can expect the gradual removal of the Map Storage bits from the codebase starting with Keycloak 23. This encompasses, among other things, closing the Map Storage issues on Github, removal of Map Store CLI options, and removal of the Map Store modules.</p> -</div> -<div class="paragraph"> -<p>In the near to mid-term future, the store team will continue to focus on cross-DC and some selected smaller improvements/refactorings for the current store. We will prioritize working on highly voted issues and pull requests provided by the community. In parallel, the plan is to develop a roadmap for features and capabilities that we want to bring to the Keycloak store after wrapping up the cross-DC work, and then share this roadmap so it can be discussed and prioritized according to the community&#8217;s feedback.</p> -</div> -<div class="paragraph"> -<p>We would also like to thank the Keycloak community for the engagement and feedback during the development of the Map Store. We know that discarding a significant amount of work is not ideal, but we are confident that this decision is the most beneficial for Keycloak and its users in the long run as it will allow us to deliver meaningful value quicker. The team remains focused on improving the store layer and is looking forward to meeting all the challenges ahead.</p> -</div> -<div class="paragraph"> -<p>Keycloak Store Team</p> -</div> -</div> -</div> - https://www.keycloak.org/2023/10/map-store-removal - Tue, 17 Oct 2023 00:00:00 GMT - - Stefan Guilhen - - - Reactivating Discourse - https://www.keycloak.org/2023/10/reactivating-discourse - <div class="paragraph"> -<p>Back in June, we decided to sunset Discourse as one of our communication -channels, as outlined in our -<a href="https://www.keycloak.org/2023/06/sunsetting-discourse.html">previous announcement</a>. -However, after careful consideration and understanding the impact this decision -had on our community, we have chosen to revert it.</p> -</div> -<div class="paragraph"> -<p>Firstly, we want to acknowledge that our first goal has always been to seek the -best for our community. While we strive to make the right decisions, we recognize -that we are not perfect. We apologize for any inconvenience our initial decision -may have caused, and appreciate the feedback received from many of you.</p> -</div> -<div class="paragraph"> -<p>We are happy to announce that -<a href="https://keycloak.discourse.group/u/dasniko">Niko</a> and -<a href="https://keycloak.discourse.group/u/xgp">Garth</a> have kindly volunteered to moderate -Discourse. Their commitment makes it possible for us to reactivate the forum. -Without their support, especially given the multiple communication channels we -manage, this would not have been possible.</p> -</div> -<div class="paragraph"> -<p>In the future, we will ensure to be transparent about decisions that impact our -users on Discourse. Thank you for your understanding, patience, and continued -support.</p> -</div> -<div class="paragraph"> -<p>The Keycloak Team</p> -</div> - https://www.keycloak.org/2023/10/reactivating-discourse - Mon, 16 Oct 2023 00:00:00 GMT - - Bruno Oliveira - - - Meet Keycloak at KubeCon Chicago in Nov 2023 - https://www.keycloak.org/2023/10/keycloak-kubeconf-chicago - <div class="paragraph"> -<p>We are thrilled to announce that Keycloak will be at KubeCon Chicago 2023. There are several Keycloak specific sessions lined up during this Conference, and we will be hosting a Kiosk at the Project Pavilion at KubeCon 2023 Chicago.</p> -</div> -<div class="sect1"> -<h2 id="_what_is_kubecon">What is KubeCon?</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>As some of you might already know, KubeCon is a fast-growing Cloud Native tech conference that is expected to have 8,000 developers, architects, and technical leaders onsite as well as thousands of participants virtually.</p> -</div> -<div class="paragraph"> -<p>KubeCon Chicago will be held from Nov. 6th, 2023 through Nov. 9th, 2023, with many of the co-located events happening on Monday Nov 6th, 2023.</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_keycloak_community_meet_greet_at_the_project_pavilion">Keycloak community Meet &amp; Greet at the Project Pavilion</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p><a href="https://github.com/ahus1">Alexander Schwartz</a>, <a href="https://github.com/mhajas">Michal Hajas</a>, <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/kami619">Kamesh Akella</a> will be at the Keycloak kiosk at the Project Pavilion. This is a great chance to meet people who use Keycloak, contribute to Keycloak, take our survey about new Keycloak features, and get some cool swag!</p> -</div> -<div class="paragraph"> -<p><strong>Keycloak Kiosk opening hours:</strong></p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Tuesday, November 7: 10:30 - 3:30 PM CST</p> -</li> -<li> -<p>Wednesday, November 8: 10:30 - 2:00 PM CST</p> -</li> -<li> -<p>Thursday, November 9: 10:30 - 12:30 PM CST</p> -</li> -</ul> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_openshift_commons_gathering">OpenShift Commons Gathering</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>The OpenShift Commons Gathering happens on Monday (Nov. 6th, 2023) and builds connections and collaboration across OpenShift communities, projects and stakeholders. Some maintainers from the Keycloak development team will be here during the afternoon. This gives a chance for more community Keycloak maintainers, contributors, and users to meet and share their ideas or just hang out. Access to the OpenShift Commons event is free and does not require a paid KubeCon ticket, <a href="https://commons.openshift.org/gatherings/kubecon-23-nov-6/">still you’ll need to register on their website in advance</a>.</p> -</div> -</div> -</div> -<div class="sect1"> -<h2 id="_keycloak_specific_events_at_kubecon">Keycloak specific events at KubeCon</h2> -<div class="sectionbody"> -<div class="paragraph"> -<p>Below are some Keycloak specific events that the attendees both in-person and virtually can plan to attend.</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Tuesday, November 7, 11:00am - 11:35am CST(UTC-6)<br> -<a href="https://kccncna2023.sched.com/event/1R2mH/10-years-of-keycloak-whats-next-for-cloud-native-authentication-and-oidc-alexander-schwartz-red-hat-takashi-norimatsu-hitachi-ltd?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>10 Years of Keycloak - What&#8217;s Next for Cloud-Native Authentication and OIDC?</strong></a><br> -By Alexander Schwartz, Red Hat &amp; Takashi Norimatsu, Hitachi, Ltd.</p> -</li> -<li> -<p>Tuesday, November 7, 11:55am - 12:30pm CST(UTC-6)<br> -<a href="https://kccncna2023.sched.com/event/1R2ma/challenge-to-implementing-scalable-authorization-with-keycloak-yoshiyuki-tabata-hitachi-ltd?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Challenge to Implementing &#8220;Scalable&#8221; Authorization with Keycloak</strong></a><br> -By Yoshiyuki Tabata, Hitachi, Ltd.</p> -</li> -<li> -<p>Tuesday, November 7, 2:30pm - 4:00pm CST(UTC-6)<br> -<a href="https://kccncna2023.sched.com/event/1R2nt/contribfest-keycloak-accelerate-new-features-squash-bugs-and-learn-to-contribute-alexander-schwartz-michal-hajas-red-hat?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Contribfest: Keycloak - Accelerate New Features, Squash Bugs and Learn to Contribute</strong></a><br> -By Alexander Schwartz &amp; Michal Hajas, Red Hat</p> -</li> -<li> -<p>Wednesday, November 8, 11:55am - 12:30pm CST(UTC-6)<br> -<a href="https://kccncna2023.sched.com/event/1R2qR/beyond-passwords-keycloaks-contributions-to-iamidentity-and-access-management-security-soojin-lee-hoon-jo-megazone?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Beyond Passwords: Keycloak&#8217;s Contributions to IAM (Identity and Access Management) + Security</strong></a><br> -By Soojin Lee &amp; Hoon Jo, Megazone</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>We&#8217;re preparing for KubeCon Chicago 2023 and can&#8217;t wait to connect with our community. Mark your calendars and join us.</p> -</div> -<div class="paragraph"> -<p>See you in Chicago!</p> -</div> -</div> -</div> - https://www.keycloak.org/2023/10/keycloak-kubeconf-chicago - Tue, 10 Oct 2023 00:00:00 GMT - - Kamesh Akella - - - Keycloak 22.0.4 released - https://www.keycloak.org/2023/10/keycloak-2204-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/10/keycloak-2204-released - Wed, 4 Oct 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 22.0.3 released - https://www.keycloak.org/2023/09/keycloak-2203-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/09/keycloak-2203-released - Tue, 12 Sep 2023 00:00:00 GMT - Keycloak Release - - - - 2nd edition of the Keycloak book is out - https://www.keycloak.org/2023/09/book-2nd-edition - <div class="paragraph"> -<p>We&#8217;re pleased to announce that the 2nd edition of the Keycloak book is out, and available for -<a href="https://a.co/d/58BbJ96">available for purchase on Amazon</a>.</p> -</div> -<div class="paragraph"> -<p>This new edition has been updated to the latest release of Keycloak, making the book compatible with the newer Quarkus -distribution of Keycloak, as well as the new administration console.</p> -</div> -<div class="paragraph"> -<p>If you are new to Keycloak this book brings an excellent guide to getting started with Keycloak, including how to secure -a range of different application types with Keycloak.</p> -</div> -<div class="paragraph"> -<p><span class="image"><img src="https://www.keycloak.org/resources/images/blog/book-2nd-edition.png" alt="Keycloak - Identity and Access Management for Modern Applications: Harness the power of Keycloak, OpenID Connect, and OAuth 2.0 to secure applications 2nd Edition"></span></p> -</div> - https://www.keycloak.org/2023/09/book-2nd-edition - Mon, 11 Sep 2023 00:00:00 GMT - - Stian Thorgersen - - - Keycloak 22.0.2 released - https://www.keycloak.org/2023/09/keycloak-2202-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/09/keycloak-2202-released - Mon, 11 Sep 2023 00:00:00 GMT - Keycloak Release - - - - Senior Software Engineer Opening on Keycloak's Core Team! - https://www.keycloak.org/2023/08/keycloak-core-hiring - <div class="paragraph"> -<p>Red Hat is looking for a Senior Software Engineer who is eager to contribute to the evolving landscape of Identity and Access Management through Keycloak. In addition to improving existing functionalities, you will have the opportunity to innovate and work on new features.</p> -</div> -<div class="paragraph"> -<p>If you have a solid Java experience, a strong interest in security, thrive in a collaborative environment, and are keen to make a meaningful impact on the IAM landscape, <a href="https://global-redhat.icims.com/jobs/100108/senior-software-engineer---identity-%26-access-management/job?mode=view&amp;mobile=false&amp;width=708&amp;height=500&amp;bga=true&amp;needsRedirect=false&amp;jan1offset=60&amp;jun1offset=120">we invite you to apply and become part of our team</a>.</p> -</div> - https://www.keycloak.org/2023/08/keycloak-core-hiring - Tue, 29 Aug 2023 00:00:00 GMT - - Bruno Oliveira - - - Keycloak 22.0.1 released - https://www.keycloak.org/2023/07/keycloak-2201-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/07/keycloak-2201-released - Tue, 18 Jul 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 22.0.0 released - https://www.keycloak.org/2023/07/keycloak-2200-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/07/keycloak-2200-released - Tue, 11 Jul 2023 00:00:00 GMT - Keycloak Release - - - - Authorization Survey - https://www.keycloak.org/2023/07/authorization-survey - <div class="paragraph"> -<p>Services dedicated to authorization are evolving rapidly. There is a steady establishment of policy languages, purpose-built for authorization, as well as a growing number of implementations of Google&#8217;s "Zanzibar" whitepaper, their <a href="https://research.google/pubs/pub48190/">global, consistent authorization system</a>.</p> -</div> -<div class="paragraph"> -<p>To better understand how we should evolve Keycloak Authorization Services in this context, we&#8217;d appreciate the opportunity to learn more about the Keycloak communities' authorization use cases and experience, regardless of whether you&#8217;ve used Keycloak Authorization Services before or if you use a different service for access management.</p> -</div> -<div class="paragraph"> -<p>Please consider filling out <a href="https://forms.gle/MkaSXQ9NuaR24qZt9">this brief, anonymous survey</a> to help shape Keycloak&#8217;s future authorization experience.</p> -</div> - https://www.keycloak.org/2023/07/authorization-survey - Thu, 6 Jul 2023 00:00:00 GMT - - Alec Henninger - - - Survey - Cross-Site Replication in Keycloak - https://www.keycloak.org/2023/06/crossdc-survey - <div class="paragraph"> -<p>The Keycloak and Infinispan engineering teams are working together to bring Cross-Site Replication (CSR) to a fully -supported state in future Keycloak releases, with Active/Passive support and Active/Active support.</p> -</div> -<div class="paragraph"> -<p>We would like to gather inputs on your expectations, requirements, use-cases and sizing of the target deployment -environments for the CSR feature. Thanks in advance for filling out this survey form to help us better plan and deliver -this feature.</p> -</div> -<div class="paragraph"> -<p>If your are interested in Active/Passive or Active/Active deployments of Keycloak please fill in -<a href="https://forms.gle/B5TogcX7WvgdeNKD6">the survey</a>.</p> -</div> - https://www.keycloak.org/2023/06/crossdc-survey - Fri, 30 Jun 2023 00:00:00 GMT - - Stian Thorgersen - - - Keycloak 21.1.2 released - https://www.keycloak.org/2023/06/keycloak-2112-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/06/keycloak-2112-released - Wed, 28 Jun 2023 00:00:00 GMT - Keycloak Release - - - - New Keycloak maintainer: Alexander Schwartz - https://www.keycloak.org/2023/06/alexander-schwartz - <div class="paragraph"> -<p>We&#8217;re delighted to announce <a href="https://github.com/ahus1">Alexander Schwartz</a> as an official maintainer of Keycloak.</p> -</div> -<div class="paragraph"> -<p>Alexander started contributing to Keycloak in 2015. He applied it in several customer installations and is maintaining the Dropwizard module for Keycloak. In January 2022, he joined Red Hat. Since then, he has contributed to Keycloak’s store and documentation and is the key contributor to the Keycloak benchmark project. He helped with Keycloak’s submission to CNCF, and represented Keycloak at KubeCon Amsterdam in April 2023. </p> -</div> -<div class="paragraph"> -<p>He has shown his commitment to the Keycloak community by collaborating on design discussions, participating in GitHub discussions, reviewing pull-requests, answering questions on the Keycloak mailing lists, contributing to new features, bug fixes and triaging GitHub issues.</p> -</div> -<div class="paragraph"> -<p>The Keycloak team is very excited to welcome Alexander as our new maintainer and long-time contributor.</p> -</div> - https://www.keycloak.org/2023/06/alexander-schwartz - Tue, 27 Jun 2023 00:00:00 GMT - - Bruno Oliveira - - - Sunsetting Discourse - https://www.keycloak.org/2023/06/sunsetting-discourse - <div class="paragraph"> -<p>Our community has grown and evolved significantly over time. This growth has -been exciting to be a part of, but it has also presented new challenges. One of -these challenges has been managing the multiple communication channels we -have in place to engage with our community.</p> -</div> -<div class="paragraph"> -<p>Today, we have various channels available: Google Groups, GitHub Discussions, -Slack, and Discourse. Each of these platforms has its strengths in fostering the -open dialogue and collaboration. However, we have been unable to provide the -level of attention and interaction we believe our community deserves.</p> -</div> -<div class="paragraph"> -<p>With this in mind, we have decided that as of June 26, 2023, we will sunset -Discourse as one of our communication channels. We understand the value -that Discourse has brought to our community, but we believe that focusing our -efforts on fewer communication channels will allow us to foster more -meaningful conversations.</p> -</div> -<div class="paragraph"> -<p>What does this mean for Discourse users?</p> -</div> -<div class="paragraph"> -<p>From June 26, 2023, users will no longer be able to create new posts on -Discourse, but they can still access all the content and discussions that have -been shared there. All the existing threads will be preserved as an archive, -ensuring that the knowledge accumulated over the years is not lost.</p> -</div> -<div class="paragraph"> -<p>For those who have been actively using Discourse, we understand that this -transition might be challenging. We encourage users to join our conversations -on <a href="https://www.keycloak.org/community">Google Groups, GitHub Discussions, and Slack</a>.</p> -</div> - https://www.keycloak.org/2023/06/sunsetting-discourse - Wed, 21 Jun 2023 00:00:00 GMT - - Bruno Oliveira - - - Keyconf 23 - https://www.keycloak.org/2023/05/keyconf-23 - <div class="paragraph"> -<p>We would like to invite you to the Keycloak conference Keyconf 23!</p> -</div> -<div class="paragraph"> -<p>The event will take place on June 16 in London. The details about this event together with the links for free registration are -<a href="https://www.eventbrite.co.uk/e/keyconf-23-tickets-621079815447">here</a>!</p> -</div> -<div class="paragraph"> -<p>The Keyconf conference takes place the day after the <a href="https://whitehallmedia.co.uk/idmjun2023/">IDM Identity Management</a> conference. If you are interested in security in general, this is a good opportunity to join the both conferences.</p> -</div> - https://www.keycloak.org/2023/05/keyconf-23 - Thu, 4 May 2023 00:00:00 GMT - - Marek Posolda - - - New Keycloak maintainer: Sebastian Schuster - https://www.keycloak.org/2023/05/maintainer-sschu - <div class="paragraph"> -<p>We are pleased to welcome <a href="https://github.com/sschu">Sebastian Schuster</a> as an official maintainer of Keycloak.</p> -</div> -<div class="paragraph"> -<p>Sebastian has contributed to Keycloak since 2019, when he convinced his company Bosch to use Keycloak for identity and -access management. He has been active in the community providing help, taking part in discussions and contributing. -Behind him, there is a whole team at Bosch providing more than 60 contributions over the last years in various areas. -The declarative user profile was the most prominent feature contributed.</p> -</div> -<div class="paragraph"> -<p>His company allows him to dedicate a considerable amount of time for Keycloak to help review contributions and reports -and get involved in discussions. Since Sebastian has got experience operating Keycloak on a wide scale over several -years, he will focus on topics around cloud-native and Keycloak operations like observability.</p> -</div> -<div class="paragraph"> -<p>Not only will Sebastian on his own bring a lot of value to Keycloak, but he will also serve as an integration point for -Bosch to enable more contributions from his team, allowing them to contribute more value to Keycloak in the future.</p> -</div> - https://www.keycloak.org/2023/05/maintainer-sschu - Tue, 2 May 2023 00:00:00 GMT - - Stian Thorgersen - - - Keycloak 21.1.1 released - https://www.keycloak.org/2023/04/keycloak-2111-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/04/keycloak-2111-released - Wed, 26 Apr 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 21.1.0 released - https://www.keycloak.org/2023/04/keycloak-2110-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/04/keycloak-2110-released - Thu, 20 Apr 2023 00:00:00 GMT - Keycloak Release - - - - Keycloak 21.0.2 released - https://www.keycloak.org/2023/03/keycloak-2102-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> -<div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> -</div> -<div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> -<div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> -<div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> -<div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> -</div> -<div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> -</div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> -</div> -<div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> -</div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> -<div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> -<div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> -</div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> -</div> -<div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> -</div> -<div class="imageblock"> -<div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> -</div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> -<div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> -</div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> -</div> -<div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> -</div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> -</div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> -</div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> -<div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> -<div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> -<div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> -<div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> -<div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> -<div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> -<div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> -<div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> -</div> -<div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> -</div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> -<div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> -</div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> -<div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> -</div> -<div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> -</div> -<div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> -</div> -<div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> -<div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> -<div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> -<div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> -</div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> -</div> -</div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> -<div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> -</div> -<div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> -</div> -<div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> -<div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> -</div> -<div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> -</div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> -</div> -</div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/03/keycloak-2102-released - Thu, 30 Mar 2023 00:00:00 GMT - Keycloak Release - - - - Update on deprecation of Keycloak adapters - https://www.keycloak.org/2023/03/adapter-deprecation-update - <div class="paragraph"> -<p>In 2022 we announced the deprecation of <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecating Keycloak adapters</a>, with -a plan to stop delivering most adapters in <a href="https://www.keycloak.org/2022/03/releases.html">Keycloak 19</a>.</p> -</div> -<div class="paragraph"> -<p>As we have not been able to make sufficient progress on finding alternatives and work on supporting material to help -migrating away from Keycloak adapters we are extending the life of the Keycloak adapters.</p> -</div> -<div class="paragraph"> -<p>The plan is still to eventually stop delivering bespoke Keycloak adapters in the future, but we will do this in a more gradual process than previous laid out.</p> -</div> -<div class="paragraph"> -<p>We still strongly belive that the community as a whole are better served in the long run by us focusing more on the Keycloak server with full compliance and support for specifications such as OAuth 2.0 and OpenID Connect, and adding support for additional relevant extensions to the specifications.</p> -</div> -<div class="paragraph"> -<p>We also believe by leaving the integration for various programming languages and frameworks to the relevant communities, the end result will be more extensive support, with more features and abilities, and last but not least better integrations and easy of use.</p> -</div> -<div class="sect1"> -<h2 id="_oauth_2_0_and_openid_connect_adapters">OAuth 2.0 and OpenID Connect adapters</h2> -<div class="sectionbody"> -<div class="sect2"> -<h3 id="_java">Java</h3> -<div class="paragraph"> -<p>For Java applications there is now more than ever wide-spread support for OpenID Connect, where some examples include:</p> +<p>The high-level topics of this documentation are:</p> </div> +<div class="dlist"> +<dl> +<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_concept_and_building_block_overview">Concept and building block overview</a></dt> +<dd> +<p>These guides include step-by-step instructions to bring up different components of the Keycloak multi-site architecture such as:</p> <div class="ulist"> <ul> <li> -<p><a href="https://jakarta.ee/specifications/security/3.0/jakarta-security-spec-3.0.html#openid-connect-annotation">Jakarta Security 3.0</a> - OpenID Connect support in Jakarta EE 10</p> -</li> -<li> -<p><a href="https://wildfly-security.github.io/wildfly-elytron/blog/securing-wildfly-apps-openid-connect/">Elytron OIDC</a> - OpenID Connect support in WildFly</p> -</li> -<li> -<p><a href="https://quarkus.io/guides/security-openid-connect">Quarkus OIDC</a> - OpenID Connect support for Quarkus applications</p> +<p>What does an active-passive setup with Keycloak architecture look like?</p> </li> <li> -<p><a href="https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html">Spring Security</a> - OAuth and OpenID Connect support in Spring</p> +<p>How to use an external database?</p> </li> <li> -<p><a href="https://www.pac4j.org/">Pac4j</a> - The Java security framework to protect all your web applications and web services</p> +<p>How to tune the resources for each of these architectural components?</p> </li> </ul> </div> -<div class="paragraph"> -<p>Neither of these have support for Keycloak Authorization Services though, which is why we are planning to introduce a -generic Java client libraries for Authorization Services that can be leveraged with other OpenID Connect client libraries. -Expect this to be delivered in Keycloak 22.</p> -</div> -<div class="paragraph"> -<p>The Keycloak Java adapters will remain for a while though, at least towards the end of the year, but likely not be removed -until early 2024. At the same time don&#8217;t expect the adapters to be updated in terms of adding new features, enhancements, or supporting newer versions of -Tomcat, Jetty, WildFly, or Spring.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_node_js">Node.js</h3> -<div class="paragraph"> -<p>We are still investigating alternatives for Node.js, so plan is available for those one just yet. Expect more information -to come later in the year. Regardless of the alternative we will deliver support for Keycloak Authorization Services to -Node.js.</p> -</div> -<div class="paragraph"> -<p>The Keycloak Node.js adapter will remain, at least towards the end of the year, but likely not be removed until early 2024.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_client_side_javascript">Client-side JavaScript</h3> -<div class="paragraph"> -<p>For now the Keycloak client-side JavaScript adapter remains, but we are looking into alternatives as well as the potential -of completely overhauling our current adapter and continue maintaining and delivering this adapter.</p> -</div> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_blueprints_for_building_blocks">Blueprints for building blocks</a></dt> +<dd> +<p>A series of guides around how to deploy Keycloak in various configurations on Amazon Web Service.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/high-availability/introduction#_operational_procedures">Operational procedures</a></dt> +<dd> +<p>These guides include detailed operational procedures, ensuring that users can set up and operate their multi-site Keycloak instances efficiently.</p> +</dd> +</dl> </div> </div> </div> <div class="sect1"> -<h2 id="_saml_2_0">SAML 2.0</h2> +<h2 id="_validation_of_the_multi_site_setup">Validation of the multi-site setup</h2> <div class="sectionbody"> <div class="paragraph"> -<p>We are planning to continue supporting SAML 2.0 for WildFly and JBoss EAP in the long run, but support for Tomcat and -Jetty are likely to be removed relatively soon.</p> -</div> -</div> -</div> - https://www.keycloak.org/2023/03/adapter-deprecation-update - Wed, 29 Mar 2023 00:00:00 GMT - - Stian Thorgersen - - - Keycloak 21.0.1 released - https://www.keycloak.org/2023/03/keycloak-2101-released - <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> - - <h2>Release notes</h2> -<div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> +<p>Before we published the guides above, we worked on the tooling that allows us both experimenting and getting reproducible results for performance, scalability and chaos testing our solution.</p> </div> <div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> +<p>With these tools, we tested first a single-site setup, and once that worked sufficiently well, also a multi-site setup.</p> </div> <div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> +<p>All these tools are available as open source, and we invite you to review them to give us feedback, and use them in your environment to run your own performance benchmark and regression tests:</p> </div> -<div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> +<div class="dlist"> +<dl> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/dataset-guide/latest/">Dataset Provider</a></dt> +<dd> +<p>Install this into a Keycloak server in a test environment, and create as many users, clients, groups, etc. as you need to run your performance benchmark. +Keycloak caches a lot of information in its internal caches, and so does the database, so you will be able to spot some problems only when you have the right amount of data in your database.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/benchmark-guide/latest/">Benchmark</a></dt> +<dd> +<p>This contains ready-to-be used scenarios for authentication flows and for Keycloak&#8217;s admin REST endpoints. +If it does not fit your needs yet, use it as a library to create your own Gatling scenarios based on existing and custom steps. +These tests are deployed as a JAR and a shell script wrapper, so you will only need to install Java on your load runners and you are ready to go.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/benchmark-guide/latest/run/running-benchmark-ansible">Dedicated EC2 load drivers</a></dt> +<dd> +<p>Use these Ansible playbooks to spin up a set of EC2 instances to drive load against a Keycloak test installation, and aggregate the results.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/prerequisite/prerequisite-rosa">Automated OpenShift installation on AWS</a></dt> +<dd> +<p>Based on Red Hat OpenShift Service on AWS (ROSA), use the scripts to provision an instance with monitoring, logging and useful Operators preconfigured, ready to deploy Keycloak.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/storage/aurora-regional-postgres">Automated Aurora installation</a></dt> +<dd> +<p>Set up an Aurora in different variants regional or global, and connect it to a ROSA environment.</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/openshift/">Opinionated Keycloak deployment for Minikube or OpenShift</a></dt> +<dd> +<p>This deploys Keycloak with additional monitoring and debugging tools so we can look at metrics, logs and traces as needed</p> +</dd> +<dt class="hdlist1"><a href="https://www.keycloak.org/keycloak-benchmark/kubernetes-guide/latest/openshift/installation-route53-loadbalancer">Scripted AWS Route 53 load balancer</a></dt> +<dd> +<p>Set up Route 53 for an active-passive setup to distribute the load to two Keycloak deployments in different OpenShift clusters</p> +</dd> +<dt class="hdlist1"><a href="https://github.com/keycloak/keycloak-benchmark/blob/main/.github/workflows/rosa-multi-az-cluster-create.yml">Scripted Multi-AZ deployment</a></dt> +<dd> +<p>Every weekday we create a new Multi-AZ setup from scratch using GitHub actions, a performance testsuite, and record the results. +This way we catch functional and performance regressions as they occur.</p> +</dd> +</dl> </div> <div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> +<p>Thank you to everyone in the community who has already tried out these tools, found bugs and submitted ideas for improvements!</p> </div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> </div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> </div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> +<div class="sect1"> +<h2 id="_keycloak_got_better_for_everyone">Keycloak got better for everyone</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>When using the tools listed above, we were able to reproduce several situations where Keycloak needed to improve. +Here are of the improvements which are available in Keycloak 23 for both single-site and multi-site setups:</p> </div> +<div class="dlist"> +<dl> +<dt class="hdlist1">Non-Blocking liveness probe</dt> +<dd> +<p>When running Keycloak under a high load, requests might queue up in a Keycloak instance. +The more requests queue up, the longer it takes to reply to the requests. +In previous versions also the requests to the liveness probe (<code>/health/live</code>) were queued, and the probe eventually timed out, and then Kubernetes restarted the Pod. +In the latest version of Keycloak, the probe is <a href="https://github.com/keycloak/keycloak/issues/22109">re-implemented to be non-blocking</a>, so it will not queue, and therefore will not time out and the Pod is not restarted under a high load.</p> +</dd> +<dt class="hdlist1">Load Shedding</dt> +<dd> +<p>When requests are queued as described above, the caller will not get a response in time, and the Pod might eventually run out of resources like memory or network connections. +The recommended recipe is to drop requests early when an instance will not be able to serve the requests in time, which is called load shedding. +Keycloak 23 now supports the <a href="https://www.keycloak.org/server/configuration-production">new option <code>http-max-queued-requests</code></a> that can limit the number of concurrent blocking requests. +When the number is exceeded, Keycloak immediately returns the response <code>503 Server not Available</code>. +This has two benefits: The caller receives an immediate response and can retry later, and resources are freed on the server side immediately.</p> +</dd> +<dt class="hdlist1">Prevented cache stampede for realms and clients</dt> +<dd> +<p>When a new Keycloak instance starts or restarts, its caches are empty. +If under high load parallel requests arrive for the same realm or the same client on a node of Keycloak, previous versions of Keycloak loaded the data from the database in each parallel request. +This caused a spike in database connection usage and an initial response delay. +The same happens when a cache or realm entry in the cache is evicted, for example, because it was modified. +The latest version of Keycloak prevents this so that each Keycloak instance will fetch the data from the database once, and all other parallel requests then use this data without querying the database again (see <a href="https://github.com/keycloak/keycloak/issues/21521">#21521</a> and <a href="https://github.com/keycloak/keycloak/issues/22988">#22988</a>, <a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a>).</p> +</dd> +<dt class="hdlist1">Align the number of JGroup threads with the number of Quarkus threads</dt> +<dd> +<p>The more Keycloak instances run in a cluster, and the more requests are processed in parallel, the higher is the load on the JGroups thread pool. +The JGroups thread pool ensures smooth communication for the embedded Infinispan of Keycloak, and could lead to timeouts on the internal Infinispan communications if its capacity is exceeded. +The high-availability docs now contain documentation on <a href="https://www.keycloak.org/high-availability/concepts-threads">how to set the Quarkus thread pool to not exceed the JGroup thread pool</a>.</p> +</dd> +<dt class="hdlist1">Improved Infinispan Metrics</dt> +<dd> +<p>The embedded Infinispan provides improved metrics that allow you to monitor your cluster. +The metrics exposed by the Keycloak&#8217;s metrics endpoint now contain only Infinispan metrics for the current node, so they will not block if another Pod is currently starting up or shutting down (<a href="https://issues.redhat.com/browse/ISPN-15042">ISPN-15042</a> and <a href="https://issues.redhat.com/browse/ISPN-15072">ISPN-15072</a>). +This way you have better visibility of your cluster during those critical moments. +The metrics can now expose the cache names as labels, so they can be plotted simpler in dashboards by adding a <code>&lt;metrics names-as-tags="true" /&gt;</code> to the Infinispan XML configuration. +Additional metrics are available for the latencies between sites.</p> +</dd> +<dt class="hdlist1">Reliable Infinispan operations</dt> +<dd> +<p>We tested Infinispan and its communication layer JGroups thoroughly, and we were able to fix situations where a state transfer stalled (<a href="https://issues.redhat.com/browse/ISPN-14982">ISPN-14982</a>), or an initial state transfer failed. +The Gossip router used in the multi-site setup now works even in situations where a load balancer has multiple IP addresses (<a href="https://issues.redhat.com/browse/JGRP-2722">JGRP-2722</a>, <a href="https://issues.redhat.com/browse/JGRP-2721">JGRP-2721</a>, <a href="https://github.com/infinispan/infinispan-operator/issues/1857">infinispan-operator#1857</a>, and <a href="https://github.com/infinispan/infinispan-operator/issues/1856">infinispan-operator#1856</a>).</p> +</dd> +</dl> </div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> </div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> </div> +<div class="sect1"> +<h2 id="_can_the_blueprints_or_scripts_be_used_in_production">Can the blueprints or scripts be used in production?</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>As part of the testing we did, we optimized Keycloak and those optimizations are built into Keycloak. +They are available without the need for additional configuration except for the JGroup thread pool configuration. +While the configuration of Keycloak on Kubernetes might match a production environment quite closely, we expect the database, network, load balancer and security hardening to be different in every organization, so you will need to adapt it to your needs.</p> </div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> <div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> +<p>This is why we chose to document the blueprints as text, so you can learn about the choices we made and why different aspects are configured in one setup, while others are at their default settings.</p> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>The scripts we use for the automated setup in the Keycloak Benchmark project focus on high availability and mix this with configurations that are simple to debug and analyze from an engineering perspective. +A production-ready setup would not have that functionality, so we do not recommend using the scripts as is. +Still, they can serve as a starting point for your own automation.</p> </div> </div> </div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> +<div class="sect1"> +<h2 id="_read_the_guides_and_give_it_a_try">Read the guides and give it a try!</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> +<p>At the moment, we are running the final tests for an active/passive setup and work toward automating more tests. +We are also looking for feedback from the community in this <a href="https://github.com/keycloak/keycloak/discussions/25269">GitHub discussion on multi-site setups</a>: Do you like what you see here? +Is something missing? +Your feedback is essential!</p> </div> <div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> +<p>Once our tests are complete, and we receive feedback from the community, we plan to make it a fully supported feature. +This is a huge opportunity for the community to engage with this setup, try it in your environment, and share your findings. +Let&#8217;s build a stronger and more resilient Keycloak together!</p> </div> -<div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> </div> +</div> + https://www.keycloak.org/2023/12/recover-site-failures + Mon, 18 Dec 2023 00:00:00 GMT + + Alexander Schwartz, Kamesh Akella + + + Keycloak 23.0.3 released + https://www.keycloak.org/2023/12/keycloak-2303-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> <div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> -</div> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> <div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="imageblock"> +<div class="listingblock"> <div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> -</div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> -<div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> -<div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> </div> <div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="imageblock"> +<div class="listingblock"> <div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> -</div> -<div class="title">Figure 2. New Account Console with custom attributes</div> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/12/keycloak-2303-released + Fri, 15 Dec 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.2 released + https://www.keycloak.org/2023/12/keycloak-2302-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> <div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> -<div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> -</div> -</div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> -</div> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -</div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> <div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> <div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> </div> <div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> </div> -<div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/12/keycloak-2302-released + Thu, 14 Dec 2023 00:00:00 GMT + Keycloak Release + + + + Join Keycloak Developer Day: A Celebration of Innovation and Community! + https://www.keycloak.org/2023/12/keycloak-dev-day-24 + <div class="paragraph"> +<p>Are you passionate about Keycloak and eager to dive deeper into this incredible Open Source IAM solution? +Then don’t miss <a href="https://keycloak-day.dev">Keycloak Developer Day</a> – a one-day, community-driven conference in Frankfurt/Main Germany in February 2024, dedicated to Keycloak and its vibrant community.</p> </div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> +<div class="sect1"> +<h2 id="_community_event_to_celebrate_keycloak">Community Event to celebrate Keycloak</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> -</div> +<p><a href="https://github.com/dasniko">Niko</a> and <a href="https://github.com/srose">I (Sebastian)</a> have been active in the Keycloak community for years and have been using Keycloak in many customer projects. +We co-organize the Java User Group Darmstadt, and participate in community events like the JavaLand conference. +Now we want to take the next step: Create a special event to celebrate and explore the vast possibilities of Keycloak. +We&#8217;re thrilled to invite you to be part of this exciting first occasion, the Keycloak Developer Day 2024!</p> </div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> -<div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> </div> </div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> +<div class="sect1"> +<h2 id="_tailored_for_users_of_keycloak">Tailored for users of Keycloak</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> +<p>We&#8217;re calling everyone using Keycloak in their day-to-day work – whether you&#8217;re tackling operational challenges, brainstorming innovative solutions to unique use-cases, or just curious about the future of IAM – to join us.</p> </div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> <div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> -</div> +<p>Expect a day filled with insightful talks, hands-on workshops, and plenty of opportunities to network with fellow Keycloak enthusiasts and Keycloak maintainers. +The feature set of Keycloak is as vast as it is impressive, promising a rich array of topics to explore.</p> </div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> -<div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> </div> </div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> +<div class="sect1"> +<h2 id="_book_your_ticket_online">Book your ticket online</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> +<p>Don&#8217;t miss this unique opportunity to connect, share, and grow with the Keycloak community. +Book your ticket today at <a href="https://keycloak-day.dev">keycloak-day.dev</a> and join us in celebrating Keycloak!</p> </div> </div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> +</div> + https://www.keycloak.org/2023/12/keycloak-dev-day-24 + Mon, 11 Dec 2023 00:00:00 GMT + + Sebastian Rose + + + Keycloak 23.0.1 released + https://www.keycloak.org/2023/11/keycloak-2301-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> +<div class="paragraph"> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> <div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> <div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> -<div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/11/keycloak-2301-released + Wed, 29 Nov 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 23.0.0 released + https://www.keycloak.org/2023/11/keycloak-2300-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Highlights</h2> <div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> <div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> <div class="listingblock"> <div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> -</div> -</div> -<div class="paragraph"> -<p>Currently only Secrets are supported.</p> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> <div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> -</div> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> -<div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> -</div> -<div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> </div> </div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> -<div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/11/keycloak-2300-released + Thu, 23 Nov 2023 00:00:00 GMT + Keycloak Release + + + + Developer Certificate of Origin + https://www.keycloak.org/2023/10/dco + <div class="paragraph"> +<p>For any Open Source project, it is important that any contributions contain code that can legally be contributed to the +project, and that the project has the right to distribute it under its license. There are many ways to achieve this, +where two popular approaches are Developer Certificate of Origin (DCO) and Contributor License Agreement (CLA).</p> </div> <div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> -</div> +<p><a href="https://developercertificate.org/">Developer Certificate of Origin (DCO)</a> is the most lightweight approach, which +requires contributors to sign-off on individual commits that are part of a contribution. This is easily done by using +the <code>--signoff</code> (<code>-s</code>) option when creating a commit. For example:</p> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> -<div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> +<div class="literalblock"> +<div class="content"> +<pre>git commit -s -m "Description of the commit"</pre> </div> </div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> <div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>This adds a <code>Signed-off-by</code> statement at the end of the commit, where the contributor certifies they are following the +agreement laid out in the <a href="https://developercertificate.org/">Developer Certificate of Origin (DCO)</a>.</p> </div> -<div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> <div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> +<p>Contributor License Agreement (CLA), on the other hand, is a more complicated approach. As part of CLA, any contributors +are required to sign an upfront agreement with the project before making any contributions. This provides a higher +barrier for contributors, and also a higher cost for the Open Source Project as it has to maintain a list of approved +contributors with a corresponding maintained archive of agreements.</p> </div> <div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> +<p>For Keycloak we decided to go with DCO as we believe it is much simpler both for contributors as well as maintainers.</p> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> -</div> +<p>If you are interested in learning more about CLA vs DCO, +<a href="https://opensource.com/article/18/3/cla-vs-dco-whats-difference">opensource.com has an excellent article on the subject</a>.</p> +</div> + https://www.keycloak.org/2023/10/dco + Tue, 31 Oct 2023 00:00:00 GMT + + Stian Thorgersen + + + Keycloak 22.0.5 released + https://www.keycloak.org/2023/10/keycloak-2205-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> <div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> </div> <div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> -<div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> -<div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/10/keycloak-2205-released + Tue, 24 Oct 2023 00:00:00 GMT + Keycloak Release + + + + Announcement: Discontinuation of Keycloak's Map Store + https://www.keycloak.org/2023/10/map-store-removal + <div class="paragraph"> +<p>Dear Keycloak community,</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> -</div> +<p>For the past two years, the Keycloak store team has been working on a <a href="https://github.com/keycloak/keycloak-community/blob/main/design/keycloak.x/storage.md">replacement for the storage layer</a>, which became known as the Map Store. Despite the successful development of many features, such as a new JPA storage layer with some no downtime capabilities, a new Hot Rod storage layer, flexible configuration, among others, the amount of work remaining for the store to be fully operational and supported is still quite significant. There is still a lot of uncertainty and risk involved in getting to the point where the store is production ready and able to provide enough value for users to migrate to it.</p> </div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> <div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> +<p>To give more context, the new Map Store still lacks support for databases other than PostgreSQL and CockroachDB, a caching layer, implementation of the tree store that ties all the stores together, a migration strategy to Map Store, thorough testing, among other things. Each of these items is complex, require a significant amount of development and testing time, and carry risks of their own.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>This situation, combined with the need to address existing issues and demands in the storage area now rather than in a somewhat distant future, led us to the tough decision to stop any development in the Map Store. Instead the team will focus on improving the capabilities of the current store and deliver these improvements in smaller chunks and quicker iterations. One of these improvements is to fully support a high availability setup for Keycloak spanning multiple data centers and regions, also known as cross-DC support. While this has been a preview feature in the past, this should now become fully supported in a future release and include guides on how to configure different parts in a cloud environment.</p> </div> -<div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> <div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> +<p>The experience we gained from the Map Store development won’t be wasted though, as the ideas and experiments that worked well in the Map Store are all natural candidates for enhancements in the storage area. Still the Map Store will be entirely removed from the main codebase. Having two different storage implementations is greatly complicating the maintenance process and also making it more difficult for users and other teams to work with the store as they need to understand how to operate on two very different implementations.</p> </div> +<div class="sect1"> +<h2 id="_whats_next">What&#8217;s next?</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>For the time being, the Map Store will be available in a separate branch, yet to be created. It will exist mainly to provide us with a way to fetch bits and pieces that can be valuable to the current store. Then, you can expect the gradual removal of the Map Storage bits from the codebase starting with Keycloak 23. This encompasses, among other things, closing the Map Storage issues on Github, removal of Map Store CLI options, and removal of the Map Store modules.</p> </div> -<div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> <div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> -</div> +<p>In the near to mid-term future, the store team will continue to focus on cross-DC and some selected smaller improvements/refactorings for the current store. We will prioritize working on highly voted issues and pull requests provided by the community. In parallel, the plan is to develop a roadmap for features and capabilities that we want to bring to the Keycloak store after wrapping up the cross-DC work, and then share this roadmap so it can be discussed and prioritized according to the community&#8217;s feedback.</p> </div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> <div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> -</div> +<p>We would also like to thank the Keycloak community for the engagement and feedback during the development of the Map Store. We know that discarding a significant amount of work is not ideal, but we are confident that this decision is the most beneficial for Keycloak and its users in the long run as it will allow us to deliver meaningful value quicker. The team remains focused on improving the store layer and is looking forward to meeting all the challenges ahead.</p> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> <div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> +<p>Keycloak Store Team</p> </div> </div> +</div> + https://www.keycloak.org/2023/10/map-store-removal + Tue, 17 Oct 2023 00:00:00 GMT + + Stefan Guilhen + + + Reactivating Discourse + https://www.keycloak.org/2023/10/reactivating-discourse + <div class="paragraph"> +<p>Back in June, we decided to sunset Discourse as one of our communication +channels, as outlined in our +<a href="https://www.keycloak.org/2023/06/sunsetting-discourse.html">previous announcement</a>. +However, after careful consideration and understanding the impact this decision +had on our community, we have chosen to revert it.</p> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> <div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> +<p>Firstly, we want to acknowledge that our first goal has always been to seek the +best for our community. While we strive to make the right decisions, we recognize +that we are not perfect. We apologize for any inconvenience our initial decision +may have caused, and appreciate the feedback received from many of you.</p> </div> <div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> +<p>We are happy to announce that +<a href="https://keycloak.discourse.group/u/dasniko">Niko</a> and +<a href="https://keycloak.discourse.group/u/xgp">Garth</a> have kindly volunteered to moderate +Discourse. Their commitment makes it possible for us to reactivate the forum. +Without their support, especially given the multiple communication channels we +manage, this would not have been possible.</p> </div> <div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> -</div> +<p>In the future, we will ensure to be transparent about decisions that impact our +users on Discourse. Thank you for your understanding, patience, and continued +support.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> -</div> +<p>The Keycloak Team</p> +</div> + https://www.keycloak.org/2023/10/reactivating-discourse + Mon, 16 Oct 2023 00:00:00 GMT + + Bruno Oliveira + + + Meet Keycloak at KubeCon Chicago in Nov 2023 + https://www.keycloak.org/2023/10/keycloak-kubeconf-chicago + <div class="paragraph"> +<p>We are thrilled to announce that Keycloak will be at KubeCon Chicago 2023. There are several Keycloak specific sessions lined up during this Conference, and we will be hosting a Kiosk at the Project Pavilion at KubeCon 2023 Chicago.</p> </div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> +<div class="sect1"> +<h2 id="_what_is_kubecon">What is KubeCon?</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> +<p>As some of you might already know, KubeCon is a fast-growing Cloud Native tech conference that is expected to have 8,000 developers, architects, and technical leaders onsite as well as thousands of participants virtually.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>KubeCon Chicago will be held from Nov. 6th, 2023 through Nov. 9th, 2023, with many of the co-located events happening on Monday Nov 6th, 2023.</p> </div> </div> -<div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> -<div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> </div> +<div class="sect1"> +<h2 id="_keycloak_community_meet_greet_at_the_project_pavilion">Keycloak community Meet &amp; Greet at the Project Pavilion</h2> +<div class="sectionbody"> +<div class="paragraph"> +<p><a href="https://github.com/ahus1">Alexander Schwartz</a>, <a href="https://github.com/mhajas">Michal Hajas</a>, <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/kami619">Kamesh Akella</a> will be at the Keycloak kiosk at the Project Pavilion. This is a great chance to meet people who use Keycloak, contribute to Keycloak, take our survey about new Keycloak features, and get some cool swag!</p> </div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> <div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> +<p><strong>Keycloak Kiosk opening hours:</strong></p> </div> <div class="ulist"> <ul> <li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> +<p>Tuesday, November 7: 10:30 - 3:30 PM CST</p> </li> <li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> +<p>Wednesday, November 8: 10:30 - 2:00 PM CST</p> </li> <li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> +<p>Thursday, November 9: 10:30 - 12:30 PM CST</p> </li> </ul> </div> +</div> +</div> +<div class="sect1"> +<h2 id="_openshift_commons_gathering">OpenShift Commons Gathering</h2> +<div class="sectionbody"> +<div class="paragraph"> +<p>The OpenShift Commons Gathering happens on Monday (Nov. 6th, 2023) and builds connections and collaboration across OpenShift communities, projects and stakeholders. Some maintainers from the Keycloak development team will be here during the afternoon. This gives a chance for more community Keycloak maintainers, contributors, and users to meet and share their ideas or just hang out. Access to the OpenShift Commons event is free and does not require a paid KubeCon ticket, <a href="https://commons.openshift.org/gatherings/kubecon-23-nov-6/">still you’ll need to register on their website in advance</a>.</p> +</div> +</div> +</div> +<div class="sect1"> +<h2 id="_keycloak_specific_events_at_kubecon">Keycloak specific events at KubeCon</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> +<p>Below are some Keycloak specific events that the attendees both in-person and virtually can plan to attend.</p> </div> <div class="ulist"> <ul> <li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> +<p>Tuesday, November 7, 11:00am - 11:35am CST(UTC-6)<br> +<a href="https://kccncna2023.sched.com/event/1R2mH/10-years-of-keycloak-whats-next-for-cloud-native-authentication-and-oidc-alexander-schwartz-red-hat-takashi-norimatsu-hitachi-ltd?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>10 Years of Keycloak - What&#8217;s Next for Cloud-Native Authentication and OIDC?</strong></a><br> +By Alexander Schwartz, Red Hat &amp; Takashi Norimatsu, Hitachi, Ltd.</p> </li> <li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> +<p>Tuesday, November 7, 11:55am - 12:30pm CST(UTC-6)<br> +<a href="https://kccncna2023.sched.com/event/1R2ma/challenge-to-implementing-scalable-authorization-with-keycloak-yoshiyuki-tabata-hitachi-ltd?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Challenge to Implementing &#8220;Scalable&#8221; Authorization with Keycloak</strong></a><br> +By Yoshiyuki Tabata, Hitachi, Ltd.</p> </li> <li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> +<p>Tuesday, November 7, 2:30pm - 4:00pm CST(UTC-6)<br> +<a href="https://kccncna2023.sched.com/event/1R2nt/contribfest-keycloak-accelerate-new-features-squash-bugs-and-learn-to-contribute-alexander-schwartz-michal-hajas-red-hat?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Contribfest: Keycloak - Accelerate New Features, Squash Bugs and Learn to Contribute</strong></a><br> +By Alexander Schwartz &amp; Michal Hajas, Red Hat</p> </li> <li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> +<p>Wednesday, November 8, 11:55am - 12:30pm CST(UTC-6)<br> +<a href="https://kccncna2023.sched.com/event/1R2qR/beyond-passwords-keycloaks-contributions-to-iamidentity-and-access-management-security-soojin-lee-hoon-jo-megazone?iframe=no&amp;w=100%&amp;sidebar=yes&amp;bg=no"><strong>Beyond Passwords: Keycloak&#8217;s Contributions to IAM (Identity and Access Management) + Security</strong></a><br> +By Soojin Lee &amp; Hoon Jo, Megazone</p> </li> </ul> </div> -</div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> -</div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> -</div> +<p>We&#8217;re preparing for KubeCon Chicago 2023 and can&#8217;t wait to connect with our community. Mark your calendars and join us.</p> </div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> <div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> +<p>See you in Chicago!</p> </div> </div> -<h2>Upgrading</h2> -<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> - -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - - - https://www.keycloak.org/2023/03/keycloak-2101-released - Wed, 1 Mar 2023 00:00:00 GMT - Keycloak Release +</div> + https://www.keycloak.org/2023/10/keycloak-kubeconf-chicago + Tue, 10 Oct 2023 00:00:00 GMT + Kamesh Akella - Keycloak 21.0.0 released - https://www.keycloak.org/2023/02/keycloak-2100-released + Keycloak 22.0.4 released + https://www.keycloak.org/2023/10/keycloak-2204-released <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> <h2>Release notes</h2> <div class="sect2"> -<h3 id="_supported_user_profile_and_progressive_profiling">Supported user profile and progressive profiling</h3> -<div class="paragraph"> -<p>The user profile preview feature is promoted to be fully supported and user profile is enabled by default.</p> -</div> -<div class="paragraph"> -<p>In the past months, the Keycloak team spent a huge amount of effort in polishing the user -profile feature to make it fully supported. In this release, we continued the effort. Lots of improvements, fixes and -polishing were done based on the thorough testing and feedback from our awesome community.</p> -</div> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The following are a few highlights of this feature;</p> -</div> -<div class="ulist"> -<ul> -<li> -<p>Fine-grained control over the attributes that users and administrators can manage so that you can prevent unexpected attributes and values from being set.</p> -</li> -<li> -<p>Ability to specify what user attributes are managed and should be displayed on the forms to regular users or administrators.</p> -</li> -<li> -<p>Dynamic forms - Previously, the forms where users created or updated their profiles, contain four basic attributes like username, email, first name and last name. The addition of any -attributes (or removing some default attributes) required you to create a custom theme. Now custom themes may not be needed because users see exactly the requested attributes based on the requirement of the particular deployment.</p> -</li> -<li> -<p>Validations - Ability to specify validators for the user attributes including built-in validators that you can use to specify a maximum or minimum length, a specific regex, or limiting a -particular attribute to be a URL or number.</p> -</li> -<li> -<p>Annotations - Ability to specify that particular attribute should be rendered for instance as a text area, an HTML select with specified options, or calendar or many other options. You can also bind JavaScript code to a specific field to change how an attribute is rendered and customize its behavior.</p> -</li> -<li> -<p>Progressive profiling - Ability to specify that some fields are required or available on the forms just for particular values of <code>scope</code> parameter. This effectively allow progressive -profiling. You no longer need to ask the user for twenty attributes during registration; you can instead ask the user to fill in attributes incrementally according to the requirements of the individual client -applications that are used by the user.</p> -</li> -<li> -<p>Migration from previous versions - The user profile is now always enabled, but it operates as before for those who did not use this feature. You can -benefit from the user profile capabilities, but you are not required to use them. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</li> -</ul> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>The first release of the user profile as a supported feature is just the starting point and the baseline for delivering many more capabilities around identity management.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> <div class="paragraph"> -<p>We would like to give huge thanks to the awesome Keycloak community as lots of ideas, requirements and contributions came from the community! Special thanks to:</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="ulist"> -<ul> -<li> -<p><a href="https://github.com/velias">Vlastimil Eliáš</a></p> -</li> -<li> -<p><a href="https://github.com/alechenninger">Alec Henninger</a></p> -</li> -<li> -<p><a href="https://github.com/thomasdarimont">Thomas Darimont</a></p> -</li> -<li> -<p><a href="https://github.com/bs-matil">Markus Till</a></p> -</li> -<li> -<p><a href="https://github.com/sschu">Sebastian Schuster</a></p> -</li> -<li> -<p><a href="https://github.com/antikalk">Oliver</a></p> -</li> -<li> -<p><a href="https://github.com/patrickjennings">Patrick Jennings</a></p> -</li> -<li> -<p><a href="https://github.com/adrhine">Andrew</a></p> -</li> -</ul> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="paragraph"> -<p>For more details about user profile capabilities, see the <a href="https://www.keycloak.org/docs/24.0.0/server_admin/#user-profile">Server Administration Guide</a>.</p> </div> -<div class="sect3"> -<h4 id="_breaking_changes_to_the_user_profile_spi">Breaking changes to the User Profile SPI</h4> <div class="paragraph"> -<p>In this release, changes to the User Profile SPI might impact existing implementations based on this SPI. For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect3"> -<h4 id="_changes_to_freemarker_templates_to_render_pages_based_on_the_user_profile_and_realm">Changes to Freemarker templates to render pages based on the user profile and realm</h4> -<div class="paragraph"> -<p>In this release, the following templates were updated to make it possible to dynamically render attributes based -on the user profile configuration set to a realm:</p> </div> -<div class="ulist"> -<ul> -<li> -<p><code>login-update-profile.ftl</code></p> -</li> -<li> -<p><code>register.ftl</code></p> -</li> -<li> -<p><code>update-email.ftl</code></p> -</li> -</ul> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/10/keycloak-2204-released + Wed, 4 Oct 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 22.0.3 released + https://www.keycloak.org/2023/09/keycloak-2203-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> +<div class="paragraph"> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_new_freemarker_template_for_the_update_profile_page_at_first_login_through_a_broker">New Freemarker template for the update profile page at first login through a broker</h4> <div class="paragraph"> -<p>In this release, the server renders the update profile page when the user is authenticating through a broker for the -first time using the <code>idp-review-user-profile.ftl</code> template.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> +</div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> +</div> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_java_adapter_deprecation_and_removal">Java adapter deprecation and removal</h3> +</div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/09/keycloak-2203-released + Tue, 12 Sep 2023 00:00:00 GMT + Keycloak Release + + + + 2nd edition of the Keycloak book is out + https://www.keycloak.org/2023/09/book-2nd-edition + <div class="paragraph"> +<p>We&#8217;re pleased to announce that the 2nd edition of the Keycloak book is out, and available for +<a href="https://a.co/d/58BbJ96">available for purchase on Amazon</a>.</p> +</div> <div class="paragraph"> -<p>Back in 2022 we announced the <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecation of Keycloak adapters in Keycloak 19</a>. -To give the community more time to adopt this <a href="https://www.keycloak.org/2023/03/adapter-deprecation-update.html">was delayed</a>.</p> +<p>This new edition has been updated to the latest release of Keycloak, making the book compatible with the newer Quarkus +distribution of Keycloak, as well as the new administration console.</p> </div> <div class="paragraph"> -<p>With that in mind, this will be the last major release of Keycloak to include OpenID Connect and SAML adapters. -As Jetty 9.x has not been supported since 2022 the Jetty adapter has been removed already in this release.</p> +<p>If you are new to Keycloak this book brings an excellent guide to getting started with Keycloak, including how to secure +a range of different application types with Keycloak.</p> </div> <div class="paragraph"> -<p>The generic Authorization Client library will continue to be supported, and aims to be used in combination with any -other OAuth 2.0 or OpenID Connect libraries.</p> +<p><span class="image"><img src="https://www.keycloak.org/resources/images/blog/book-2nd-edition.png" alt="Keycloak - Identity and Access Management for Modern Applications: Harness the power of Keycloak, OpenID Connect, and OAuth 2.0 to secure applications 2nd Edition"></span></p> +</div> + https://www.keycloak.org/2023/09/book-2nd-edition + Mon, 11 Sep 2023 00:00:00 GMT + + Stian Thorgersen + + + Keycloak 22.0.2 released + https://www.keycloak.org/2023/09/keycloak-2202-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> +<div class="paragraph"> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>The only adapter we will continue to deliver is the SAML adapter for latest releases of WildFly and EAP 8.x. Reasoning -for continuing to support this is down to the fact that the majority of the SAML codebase in Keycloak was a contribution -from WildFly. As part of this contribution we agreed to maintain SAML adapters for WildFly and EAP in the long run.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_jetty_adapter_removed">Jetty adapter removed</h4> <div class="paragraph"> -<p>Jetty 9.4 has not been supported in the community for a long time, and reached end-of-life in 2022. At the same time the -adapter has not been updated or tested with more recent versions of Jetty. For these reasons the Jetty adapter has been -removed from this release.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_new_welcome_page">New Welcome Page</h3> <div class="paragraph"> -<p>The 'welcome' page that appears at the first use of Keycloak is redesigned. It provides a better setup experience and conforms to the latest version of <a href="https://www.patternfly.org/">PatternFly</a>. The simplified page layout includes only a form to register the first administrative user. After completing the registration, the user is sent directly to the Admin Console.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="imageblock"> +<div class="listingblock"> <div class="content"> -<img src="images/new-welcome-screen.png" alt="New welcome page with a simplified layout and registration form"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="title">Figure 1. New welcome page with a simplified layout and registration form</div> </div> -<div class="paragraph"> -<p>If you use a custom theme, you may need to update it to support the new welcome page. For details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/09/keycloak-2202-released + Mon, 11 Sep 2023 00:00:00 GMT + Keycloak Release + + + + Senior Software Engineer Opening on Keycloak's Core Team! + https://www.keycloak.org/2023/08/keycloak-core-hiring + <div class="paragraph"> +<p>Red Hat is looking for a Senior Software Engineer who is eager to contribute to the evolving landscape of Identity and Access Management through Keycloak. In addition to improving existing functionalities, you will have the opportunity to innovate and work on new features.</p> </div> +<div class="paragraph"> +<p>If you have a solid Java experience, a strong interest in security, thrive in a collaborative environment, and are keen to make a meaningful impact on the IAM landscape, <a href="https://global-redhat.icims.com/jobs/100108/senior-software-engineer---identity-%26-access-management/job?mode=view&amp;mobile=false&amp;width=708&amp;height=500&amp;bga=true&amp;needsRedirect=false&amp;jan1offset=60&amp;jun1offset=120">we invite you to apply and become part of our team</a>.</p> +</div> + https://www.keycloak.org/2023/08/keycloak-core-hiring + Tue, 29 Aug 2023 00:00:00 GMT + + Bruno Oliveira + + + Keycloak 22.0.1 released + https://www.keycloak.org/2023/07/keycloak-2201-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_new_account_console_now_the_default">New Account Console now the default</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>We introduced version 3 of the Account Console in Keycloak 22 as a preview feature. In this release, we are making it the default version, and deprecating version 2 in the process, which will be removed in a subsequent release.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>This new version has built-in support for the user profile feature, which allows administrators to configure which attributes are available to users in the Account Console, and lands a user directly on their personal account page after logging in.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="imageblock"> +<div class="paragraph"> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> +</div> +<div class="listingblock"> <div class="content"> -<img src="images/new-account-console.png" alt="New Account Console with custom attributes"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="title">Figure 2. New Account Console with custom attributes</div> </div> <div class="paragraph"> -<p>If you are using or extending the customization features of this theme, you may need to perform additional migrations. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> +</div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> </div> +</div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/07/keycloak-2201-released + Tue, 18 Jul 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 22.0.0 released + https://www.keycloak.org/2023/07/keycloak-2200-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_keycloak_js">Keycloak JS</h3> -<div class="sect3"> -<h4 id="_using_exports_field_in_package_json">Using <code>exports</code> field in <code>package.json</code></h4> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The Keycloak JS adapter now uses the <a href="https://webpack.js.org/guides/package-exports/"><code>exports</code> field</a> in its <code>package.json</code>. This change improves support for more modern bundlers like Webpack 5 and Vite, but comes with some unavoidable breaking changes. See the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a> for more details.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> +<div class="paragraph"> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_pkce_enabled_by_default">PKCE enabled by default</h4> <div class="paragraph"> -<p>The Keycloak JS adapter now sets the <code>pkceMethod</code> option to <code>S256</code> by default. This change enables Proof Key Code Exchange (<a href="https://datatracker.ietf.org/doc/html/rfc7636">PKCE</a>) for all applications using the adapter. If you use the adapter on a system that does not support PKCE, you can set the <code>pkceMethod</code> option to <code>false</code> to disable it.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_changes_to_password_hashing">Changes to Password Hashing</h3> <div class="paragraph"> -<p>In this release, we adapted the password hashing defaults to match the <a href="https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pbkdf2">OWASP recommendations for Password Storage</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -<div class="paragraph"> -<p>As part of this change, the default password hashing provider has changed from <code>pbkdf2-sha256</code> to <code>pbkdf2-sha512</code>. -Also, the number of default hash iterations for <code>pbkdf2</code> based password hashing algorithms changed. This change means better security aligned with latest recommendations, but -it has impact on performance. It is possible to stick to the old behaviour by adding password policies <code>hashAlgorithm</code> and <code>hashIterations</code> to your realm. For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_oauthoidc_related_improvements">OAuth/OIDC related improvements</h3> -<div class="sect3"> -<h4 id="_lightweight_access_tokens_support">Lightweight access tokens support</h4> -<div class="paragraph"> -<p>This release contains support for Lightweight access tokens. As a result, you can have smaller access tokens for specified clients. These tokens have only a few -claims, which is why they are smaller. Note that lightweight access token is still JWT signed by the realm key by default and still contains some very basic claims.</p> +</div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/07/keycloak-2200-released + Tue, 11 Jul 2023 00:00:00 GMT + Keycloak Release + + + + Authorization Survey + https://www.keycloak.org/2023/07/authorization-survey + <div class="paragraph"> +<p>Services dedicated to authorization are evolving rapidly. There is a steady establishment of policy languages, purpose-built for authorization, as well as a growing number of implementations of Google&#8217;s "Zanzibar" whitepaper, their <a href="https://research.google/pubs/pub48190/">global, consistent authorization system</a>.</p> </div> <div class="paragraph"> -<p>This release introduces an <strong>Add to lightweight access token</strong> flag that is available on some OIDC protocol mappers. Use this flag to specify if a particular claim should be added to a lightweight -access token. It is <strong>OFF</strong> by default, which means that most claims are not added.</p> +<p>To better understand how we should evolve Keycloak Authorization Services in this context, we&#8217;d appreciate the opportunity to learn more about the Keycloak communities' authorization use cases and experience, regardless of whether you&#8217;ve used Keycloak Authorization Services before or if you use a different service for access management.</p> </div> <div class="paragraph"> -<p>Also, a client policy executor exists. Use it to specify if a particular client request -should use lightweight access tokens or regular access tokens. An alternative to the executor is to use an <strong>Always use lightweight access token</strong> flag on client advanced -settings, which causes that client to always use lightweight access tokens. An executor can be an alternative if you need -more flexibility. For instance, you may choose to use lightweight access tokens by default but use regular tokens only for the specified <strong>scope</strong> parameter.</p> +<p>Please consider filling out <a href="https://forms.gle/MkaSXQ9NuaR24qZt9">this brief, anonymous survey</a> to help shape Keycloak&#8217;s future authorization experience.</p> +</div> + https://www.keycloak.org/2023/07/authorization-survey + Thu, 6 Jul 2023 00:00:00 GMT + + Alec Henninger + + + Survey - Cross-Site Replication in Keycloak + https://www.keycloak.org/2023/06/crossdc-survey + <div class="paragraph"> +<p>The Keycloak and Infinispan engineering teams are working together to bring Cross-Site Replication (CSR) to a fully +supported state in future Keycloak releases, with Active/Passive support and Active/Active support.</p> </div> <div class="paragraph"> -<p>A previous release added an <strong>Add to token introspection</strong> switch. You use it to add -claims that are not present in the access token into the introspection endpoint response.</p> +<p>We would like to gather inputs on your expectations, requirements, use-cases and sizing of the target deployment +environments for the CSR feature. Thanks in advance for filling out this survey form to help us better plan and deliver +this feature.</p> </div> <div class="paragraph"> -<p>Thanks to <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution and Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> for a help and review of this feature.</p> +<p>If your are interested in Active/Passive or Active/Active deployments of Keycloak please fill in +<a href="https://forms.gle/B5TogcX7WvgdeNKD6">the survey</a>.</p> +</div> + https://www.keycloak.org/2023/06/crossdc-survey + Fri, 30 Jun 2023 00:00:00 GMT + + Stian Thorgersen + + + Keycloak 21.1.2 released + https://www.keycloak.org/2023/06/keycloak-2112-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> +<div class="sect2"> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> +<div class="paragraph"> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> +<div class="paragraph"> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_oauth_2_1_support">OAuth 2.1 support</h4> <div class="paragraph"> -<p>This release contains optional OAuth 2.1 support. New client policy profiles were introduced in this release, which administrators can use to make sure that clients and particular client requests comply with the OAuth 2.1 specification. A dedicated client profile exists for confidential clients and a dedicated profile for public clients. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/skabano">Shigeyuki Kabano</a> for the contribution.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> +</div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect3"> -<h4 id="_scope_parameter_supported_in_the_refresh_token_flow">Scope parameter supported in the refresh token flow</h4> <div class="paragraph"> -<p>Starting with this release, the <strong>scope</strong> parameter in the OAuth2/OIDC endpoint for token refresh is supported. Use this parameter to request access tokens with a smaller amount -of scopes than originally granted, which means you cannot increase access token scope. This scope limitation does not affect the scope of the refreshed refresh token. This function works as -described in the OAuth2 specification. -Thanks to <a href="https://github.com/cgeorgilakis">Konstantinos Georgilakis</a> for the contribution.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> +</div> +</div> +</div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/06/keycloak-2112-released + Wed, 28 Jun 2023 00:00:00 GMT + Keycloak Release + + + + New Keycloak maintainer: Alexander Schwartz + https://www.keycloak.org/2023/06/alexander-schwartz + <div class="paragraph"> +<p>We&#8217;re delighted to announce <a href="https://github.com/ahus1">Alexander Schwartz</a> as an official maintainer of Keycloak.</p> </div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_secure_redirect_uris">Client policy executor for secure redirect URIs</h4> <div class="paragraph"> -<p>A new client policy executor <code>secure-redirect-uris-enforcer</code> is introduced. Use it to restrict which redirect URIs can be used by the clients. For instance, -you can specify that client redirect URIs cannot have wildcards, should be just from specific domain, must be OAuth 2.1 compliant, and so on. -Thanks to <a href="https://github.com/lexcao">Lex Cao</a> and <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> +<p>Alexander started contributing to Keycloak in 2015. He applied it in several customer installations and is maintaining the Dropwizard module for Keycloak. In January 2022, he joined Red Hat. Since then, he has contributed to Keycloak’s store and documentation and is the key contributor to the Keycloak benchmark project. He helped with Keycloak’s submission to CNCF, and represented Keycloak at KubeCon Amsterdam in April 2023. </p> </div> +<div class="paragraph"> +<p>He has shown his commitment to the Keycloak community by collaborating on design discussions, participating in GitHub discussions, reviewing pull-requests, answering questions on the Keycloak mailing lists, contributing to new features, bug fixes and triaging GitHub issues.</p> </div> -<div class="sect3"> -<h4 id="_client_policy_executor_for_enforcing_dpop">Client policy executor for enforcing DPoP</h4> <div class="paragraph"> -<p>A new client policy executor <code>dpop-bind-enforcer</code> is introduced. You can use it to enforce DPoP for a particular client if <code>dpop</code> preview - is enabled. -Thanks to <a href="https://github.com/tnorimat">Takashi Norimatsu</a> for the contribution.</p> +<p>The Keycloak team is very excited to welcome Alexander as our new maintainer and long-time contributor.</p> +</div> + https://www.keycloak.org/2023/06/alexander-schwartz + Tue, 27 Jun 2023 00:00:00 GMT + + Bruno Oliveira + + + Sunsetting Discourse + https://www.keycloak.org/2023/06/sunsetting-discourse + <div class="paragraph"> +<p>Our community has grown and evolved significantly over time. This growth has +been exciting to be a part of, but it has also presented new challenges. One of +these challenges has been managing the multiple communication channels we +have in place to engage with our community.</p> </div> +<div class="paragraph"> +<p>Today, we have various channels available: Google Groups, GitHub Discussions, +Slack, and Discourse. Each of these platforms has its strengths in fostering the +open dialogue and collaboration. However, we have been unable to provide the +level of attention and interaction we believe our community deserves.</p> </div> -<div class="sect3"> -<h4 id="_supporting_eddsa">Supporting EdDSA</h4> <div class="paragraph"> -<p>You can create EdDSA realm keys and use them as signature algorithms for various clients. For instance, you can use these keys to sign tokens or for client authentication with signed JWT. -This feature includes identity brokering where Keycloak itself signs client assertions that are used for <code>private_key_jwt</code> authentication to third party identity providers. -Thanks to -<a href="https://github.com/tnorimat">Takashi Norimatsu</a> and <a href="https://github.com/MuhammadZakwan">Muhammad Zakwan Bin Mohd Zahid</a> for the contribution.</p> +<p>With this in mind, we have decided that as of June 26, 2023, we will sunset +Discourse as one of our communication channels. We understand the value +that Discourse has brought to our community, but we believe that focusing our +efforts on fewer communication channels will allow us to foster more +meaningful conversations.</p> </div> +<div class="paragraph"> +<p>What does this mean for Discourse users?</p> </div> -<div class="sect3"> -<h4 id="_ec_keys_supported_by_javakeystore_provider">EC Keys supported by JavaKeystore provider</h4> <div class="paragraph"> -<p>The provider <code>JavaKeystoreProvider</code> for providing realm keys now supports EC keys in addition to previously supported RSA keys. -Thanks to <a href="https://github.com/wistefan">Stefan Wiedemann</a> for the contribution.</p> +<p>From June 26, 2023, users will no longer be able to create new posts on +Discourse, but they can still access all the content and discussions that have +been shared there. All the existing threads will be preserved as an archive, +ensuring that the knowledge accumulated over the years is not lost.</p> </div> +<div class="paragraph"> +<p>For those who have been actively using Discourse, we understand that this +transition might be challenging. We encourage users to join our conversations +on <a href="https://www.keycloak.org/community">Google Groups, GitHub Discussions, and Slack</a>.</p> +</div> + https://www.keycloak.org/2023/06/sunsetting-discourse + Wed, 21 Jun 2023 00:00:00 GMT + + Bruno Oliveira + + + Keyconf 23 + https://www.keycloak.org/2023/05/keyconf-23 + <div class="paragraph"> +<p>We would like to invite you to the Keycloak conference Keyconf 23!</p> </div> -<div class="sect3"> -<h4 id="_option_to_add_x509_thumbprint_to_jwt_when_using_private_key_jwt_authentication_for_identity_providers">Option to add X509 thumbprint to JWT when using private_key_jwt authentication for identity providers</h4> <div class="paragraph"> -<p>OIDC identity providers now have the <strong>Add X.509 Headers to the JWT</strong> option for the situation when client authentication with JWT signed by private key is used. This option can be useful -for interoperability with some identity providers such as Azure AD, which require the thumbprint to be present on the JWT. -Thanks to <a href="https://github.com/MikeTangoEcho">MT</a> for the contribution.</p> +<p>The event will take place on June 16 in London. The details about this event together with the links for free registration are +<a href="https://www.eventbrite.co.uk/e/keyconf-23-tickets-621079815447">here</a>!</p> </div> +<div class="paragraph"> +<p>The Keyconf conference takes place the day after the <a href="https://whitehallmedia.co.uk/idmjun2023/">IDM Identity Management</a> conference. If you are interested in security in general, this is a good opportunity to join the both conferences.</p> +</div> + https://www.keycloak.org/2023/05/keyconf-23 + Thu, 4 May 2023 00:00:00 GMT + + Marek Posolda + + + New Keycloak maintainer: Sebastian Schuster + https://www.keycloak.org/2023/05/maintainer-sschu + <div class="paragraph"> +<p>We are pleased to welcome <a href="https://github.com/sschu">Sebastian Schuster</a> as an official maintainer of Keycloak.</p> </div> -<div class="sect3"> -<h4 id="_oauth_grant_type_spi">OAuth Grant Type SPI</h4> <div class="paragraph"> -<p>The Keycloak codebase includes an internal update to introduce the OAuth Grant Type SPI. This update allows additional flexibility when introducing custom grant types -supported by the Keycloak OAuth 2 token endpoint. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> -</div> +<p>Sebastian has contributed to Keycloak since 2019, when he convinced his company Bosch to use Keycloak for identity and +access management. He has been active in the community providing help, taking part in discussions and contributing. +Behind him, there is a whole team at Bosch providing more than 60 contributions over the last years in various areas. +The declarative user profile was the most prominent feature contributed.</p> </div> -<div class="sect2"> -<h3 id="_cors_improvements">CORS improvements</h3> <div class="paragraph"> -<p>The CORS related Keycloak functionality was extracted into the SPI, which can allow additional flexibility. Note that <code>CorsSPI</code> is internal and may change at a future release. -Thanks to <a href="https://github.com/dteleguin">Dmitry Telegin</a> for the contribution.</p> -</div> +<p>His company allows him to dedicate a considerable amount of time for Keycloak to help review contributions and reports +and get involved in discussions. Since Sebastian has got experience operating Keycloak on a wide scale over several +years, he will focus on topics around cloud-native and Keycloak operations like observability.</p> </div> -<div class="sect2"> -<h3 id="_truststore_improvements">Truststore improvements</h3> <div class="paragraph"> -<p>Keycloak introduces improved truststores configuration options. The Keycloak truststore is now used across the server, including outgoing connections, mTLS, and database drivers. You no longer need to configure separate truststores for individual areas. To configure the truststore, you can put your truststores files or certificates in the default <code>conf/truststores</code>, or use the new <code>truststore-paths</code> config option. For details refer to the relevant <a href="https://www.keycloak.org/server/keycloak-truststore">guide</a>.</p> -</div> -</div> +<p>Not only will Sebastian on his own bring a lot of value to Keycloak, but he will also serve as an integration point for +Bosch to enable more contributions from his team, allowing them to contribute more value to Keycloak in the future.</p> +</div> + https://www.keycloak.org/2023/05/maintainer-sschu + Tue, 2 May 2023 00:00:00 GMT + + Stian Thorgersen + + + Keycloak 21.1.1 released + https://www.keycloak.org/2023/04/keycloak-2111-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_versioned_features">Versioned Features</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Features now support versioning. To preserve backward compatibility, all existing features (including <code>account2</code> and <code>account3</code>) are marked as version 1. Newly introduced features will use versioning, which means that users can select between different implementations of desired features.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>For details refer to the <a href="https://www.keycloak.org/server/features">features guide</a>.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -<div class="sect3"> -<h4 id="_keycloak_cr_truststores">Keycloak CR Truststores</h4> <div class="paragraph"> -<p>You may also take advantage of the new server-side handling of truststores by using the Keycloak CR, for example:</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> <div class="listingblock"> <div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">spec: - truststores: - mystore: - secret: - name: mystore-secret - myotherstore: - secret: - name: myotherstore-secret</code></pre> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> <div class="paragraph"> -<p>Currently only Secrets are supported.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> -</div> -<div class="sect3"> -<h4 id="_trust_kubernetes_ca">Trust Kubernetes CA</h4> -<div class="paragraph"> -<p>The cert for the Kubernetes CA is added automatically to your Keycloak Pods managed by the Operator.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/04/keycloak-2111-released + Wed, 26 Apr 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 21.1.0 released + https://www.keycloak.org/2023/04/keycloak-2110-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_automatic_certificate_management_for_saml_identity_providers">Automatic certificate management for SAML identity providers</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The SAML identity providers can now be configured to automatically download the signing certificates from the IDP entity metadata descriptor endpoint. In order to use the new feature, configure the <code>Metadata descriptor URL</code> option in the provider (the URL where the IDP metadata information with the certificates is published) and set <code>Use metadata descriptor URL</code> to <code>ON</code>. The certificates are automatically downloaded and cached in the <code>public-key-storage</code> SPI from that URL. The certificates can also be reloaded or imported from the Admin Console, using the action combo in the provider page.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>See the <a href="https://www.keycloak.org/docs/latest/server_admin/index.html#saml-v2-0-identity-providers">documentation</a> for more details about the new options.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> -</div> -<div class="sect2"> -<h3 id="_non_blocking_health_check_for_load_balancers">Non-blocking health check for load balancers</h3> <div class="paragraph"> -<p>A new health check endpoint available at <code>/lb-check</code> was added. -The execution is running in the event loop, which means this check is responsive also in overloaded situations when Keycloak needs to handle many requests waiting in request queue. -This behavior is useful, for example, in multi-site deployment to avoid failing over to another site that is under heavy load. -The endpoint is currently checking availability of the embedded and external Infinispan caches. Other checks may be added later.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> -<div class="paragraph"> -<p>This endpoint is not available by default. -To enable it, run Keyloak with the <code>multi-site</code> feature. -For more details, see <a href="https://www.keycloak.org/server/features">Enabling and disabling features</a>.</p> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_optimized_field">Keycloak CR Optimized Field</h3> <div class="paragraph"> -<p>The Keycloak CR now includes an <code>startOptimized</code> field, which may be used to override the default assumption about whether to use the <code>--optimized</code> flag for the start command. -As a result, you can use the CR to configure build time options also when a custom Keycloak image is used.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_enhanced_reverse_proxy_settings">Enhanced reverse proxy settings</h3> -<div class="paragraph"> -<p>It is now possible to separately enable parsing of either <code>Forwarded</code> or <code>X-Forwarded-*</code> headers by using the new <code>--proxy-headers</code> option. -For details, see the <a href="https://www.keycloak.org/server/reverseproxy">Reverse Proxy Guide</a>. -The original <code>--proxy</code> option is now deprecated and will be removed in a future release. For migration instructions, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/04/keycloak-2110-released + Thu, 20 Apr 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 21.0.2 released + https://www.keycloak.org/2023/03/keycloak-2102-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_changes_to_the_user_representation_in_both_admin_api_and_account_contexts">Changes to the user representation in both Admin API and Account contexts</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>In this release, we are encapsulating the root user attributes (such as <code>username</code>, <code>email</code>, <code>firstName</code>, <code>lastName</code>, and <code>locale</code>) by moving them to a base/abstract class in order to align how these attributes -are marshalled and unmarshalled when using both Admin and Account REST APIs.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>This strategy provides consistency in how attributes are managed by clients and makes sure they conform to the user profile -configuration set to a realm.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_sequential_loading_of_offline_sessions_and_remote_sessions">Sequential loading of offline sessions and remote sessions</h3> -<div class="paragraph"> -<p>Starting with this release, the first member of a Keycloak cluster will load remote sessions sequentially instead of in parallel. -If offline session preloading is enabled, those will be loaded sequentially as well.</p> </div> <div class="paragraph"> -<p>For more details, see the <a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_performing_actions_on_behalf_of_another_already_authenticated_user_is_not_longer_possible">Performing actions on behalf of another already authenticated user is not longer possible</h3> -<div class="paragraph"> -<p>In this release, you can no longer perform actions such as email verification if the user is already authenticated -and the action is bound to another user. For instance, a user can not complete the verification email flow if the email link -is bound to a different account.</p> </div> </div> -<div class="sect2"> -<h3 id="_changes_to_the_email_verification_flow">Changes to the email verification flow</h3> -<div class="paragraph"> -<p>In this release, if a user tries to follow the link to verify the email and the email was previously verified, a proper message -will be shown.</p> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/03/keycloak-2102-released + Thu, 30 Mar 2023 00:00:00 GMT + Keycloak Release + + + + Update on deprecation of Keycloak adapters + https://www.keycloak.org/2023/03/adapter-deprecation-update + <div class="paragraph"> +<p>In 2022 we announced the deprecation of <a href="https://www.keycloak.org/2022/02/adapter-deprecation.html">deprecating Keycloak adapters</a>, with +a plan to stop delivering most adapters in <a href="https://www.keycloak.org/2022/03/releases.html">Keycloak 19</a>.</p> </div> <div class="paragraph"> -<p>In addition to that, a new error (<code>EMAIL_ALREADY_VERIFIED</code>) event will be fired to indicate an attempt to verify an already verified email. You can -use this event to track possible attempts to hijack user accounts in case the link has leaked or to alert users if they do not recognize the action.</p> -</div> +<p>As we have not been able to make sufficient progress on finding alternatives and work on supporting material to help +migrating away from Keycloak adapters we are extending the life of the Keycloak adapters.</p> </div> -<div class="sect2"> -<h3 id="_deprecated_offline_session_preloading">Deprecated offline session preloading</h3> <div class="paragraph"> -<p>The default behavior of Keycloak is to load offline sessions on demand. -The old behavior to preload them at startup is now deprecated, as pre-loading them at startup does not scale well with a growing number of sessions, and increases Keycloak memory usage. The old behavior will be removed in a future release.</p> +<p>The plan is still to eventually stop delivering bespoke Keycloak adapters in the future, but we will do this in a more gradual process than previous laid out.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> -</div> +<p>We still strongly belive that the community as a whole are better served in the long run by us focusing more on the Keycloak server with full compliance and support for specifications such as OAuth 2.0 and OpenID Connect, and adding support for additional relevant extensions to the specifications.</p> </div> -<div class="sect2"> -<h3 id="_configuration_option_for_offline_session_lifespan_override_in_memory">Configuration option for offline session lifespan override in memory</h3> <div class="paragraph"> -<p>To reduce memory requirements, we introduced a configuration option to shorten lifespan for offline sessions imported into the Infinispan caches. Currently, the offline session lifespan override is disabled by default.</p> +<p>We also believe by leaving the integration for various programming languages and frameworks to the relevant communities, the end result will be more extensive support, with more features and abilities, and last but not least better integrations and easy of use.</p> </div> +<div class="sect1"> +<h2 id="_oauth_2_0_and_openid_connect_adapters">OAuth 2.0 and OpenID Connect adapters</h2> +<div class="sectionbody"> +<div class="sect2"> +<h3 id="_java">Java</h3> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/server_admin/#_offline-access">Server Administration Guide</a>.</p> +<p>For Java applications there is now more than ever wide-spread support for OpenID Connect, where some examples include:</p> </div> +<div class="ulist"> +<ul> +<li> +<p><a href="https://jakarta.ee/specifications/security/3.0/jakarta-security-spec-3.0.html#openid-connect-annotation">Jakarta Security 3.0</a> - OpenID Connect support in Jakarta EE 10</p> +</li> +<li> +<p><a href="https://wildfly-security.github.io/wildfly-elytron/blog/securing-wildfly-apps-openid-connect/">Elytron OIDC</a> - OpenID Connect support in WildFly</p> +</li> +<li> +<p><a href="https://quarkus.io/guides/security-openid-connect">Quarkus OIDC</a> - OpenID Connect support for Quarkus applications</p> +</li> +<li> +<p><a href="https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html">Spring Security</a> - OAuth and OpenID Connect support in Spring</p> +</li> +<li> +<p><a href="https://www.pac4j.org/">Pac4j</a> - The Java security framework to protect all your web applications and web services</p> +</li> +</ul> </div> -<div class="sect2"> -<h3 id="_infinispan_metrics_use_labels_for_cache_manager_and_cache_names">Infinispan metrics use labels for cache manager and cache names</h3> <div class="paragraph"> -<p>When enabling metrics for Keycloak&#8217;s embedded caches, the metrics now use labels for the cache manager and the cache names.</p> +<p>Neither of these have support for Keycloak Authorization Services though, which is why we are planning to introduce a +generic Java client libraries for Authorization Services that can be leveraged with other OpenID Connect client libraries. +Expect this to be delivered in Keycloak 22.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>The Keycloak Java adapters will remain for a while though, at least towards the end of the year, but likely not be removed +until early 2024. At the same time don&#8217;t expect the adapters to be updated in terms of adding new features, enhancements, or supporting newer versions of +Tomcat, Jetty, WildFly, or Spring.</p> </div> </div> <div class="sect2"> -<h3 id="_user_attribute_value_length_extension">User attribute value length extension</h3> +<h3 id="_node_js">Node.js</h3> <div class="paragraph"> -<p>As of this release, Keycloak supports storing and searching by user attribute values longer than 255 characters, which was previously a limitation.</p> +<p>We are still investigating alternatives for Node.js, so plan is available for those one just yet. Expect more information +to come later in the year. Regardless of the alternative we will deliver support for Keycloak Authorization Services to +Node.js.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> +<p>The Keycloak Node.js adapter will remain, at least towards the end of the year, but likely not be removed until early 2024.</p> </div> </div> <div class="sect2"> -<h3 id="_brute_force_protection_changes">Brute Force Protection changes</h3> +<h3 id="_client_side_javascript">Client-side JavaScript</h3> <div class="paragraph"> -<p>There have been a couple of enhancements to the Brute Protection:</p> -</div> -<div class="olist arabic"> -<ol class="arabic"> -<li> -<p>When an attempt to authenticate with an OTP or Recovery Code fails due to Brute Force Protection the active Authentication Session is invalidated. Any further attempts to authenticate with that session will fail.</p> -</li> -<li> -<p>In previous versions of Keycloak, the administrator had to choose between disabling users temporarily or permanently due to a Brute Force attack on their accounts. The administrator can now permanently disable a user after a given number of temporary lockouts.</p> -</li> -<li> -<p>The property <code>failedLoginNotBefore</code> has been added to the <code>brute-force/users/{userId}</code> endpoint</p> -</li> -</ol> +<p>For now the Keycloak client-side JavaScript adapter remains, but we are looking into alternatives as well as the potential +of completely overhauling our current adapter and continue maintaining and delivering this adapter.</p> </div> </div> -<div class="sect2"> -<h3 id="_authorization_policy">Authorization Policy</h3> -<div class="paragraph"> -<p>In previous versions of Keycloak, when the last member of a User, Group or Client policy was deleted then that policy would also be deleted. Unfortunately this could lead to an escalation of privileges if the policy was used in an aggregate policy. To avoid privilege escalation the effect policies are no longer deleted and an administrator will need to update those policies.</p> </div> </div> -<div class="sect2"> -<h3 id="_keycloak_cr_cache_config_file_option">Keycloak CR cache-config-file option</h3> +<div class="sect1"> +<h2 id="_saml_2_0">SAML 2.0</h2> +<div class="sectionbody"> <div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>cache-config-file</code> option by using the <code>cache</code> spec <code>configMapFile</code> field, for example:</p> -</div> -<div class="listingblock"> -<div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - cache: - configMapFile: - name: my-configmap - key: config.xml</code></pre> -</div> +<p>We are planning to continue supporting SAML 2.0 for WildFly and JBoss EAP in the long run, but support for Tomcat and +Jetty are likely to be removed relatively soon.</p> </div> </div> +</div> + https://www.keycloak.org/2023/03/adapter-deprecation-update + Wed, 29 Mar 2023 00:00:00 GMT + + Stian Thorgersen + + + Keycloak 21.0.1 released + https://www.keycloak.org/2023/03/keycloak-2101-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_keycloak_cr_resources_options">Keycloak CR resources options</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>The Keycloak CR now allows for specifying the <code>resources</code> options for managing compute resources for the Keycloak container. -It provides the ability to request and limit resources independently for the main Keycloak deployment via the Keycloak CR, and for the realm import Job via the Realm Import CR.</p> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> <div class="paragraph"> -<p>When no values are specified, the default <code>requests</code> memory is set to <code>1700MiB</code>, and the <code>limits</code> memory is set to <code>2GiB</code>.</p> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> <div class="paragraph"> -<p>You can specify your custom values based on your requirements as follows:</p> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> <div class="listingblock"> <div class="content"> -<pre class="highlight"><code class="language-yaml" data-lang="yaml">apiVersion: k8s.keycloak.org/v2alpha1 -kind: Keycloak -metadata: - name: example-kc -spec: - ... - resources: - requests: - cpu: 1200m - memory: 896Mi - limits: - cpu: 6 - memory: 3Gi</code></pre> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/operator/advanced-configuration">Operator Advanced configuration</a>.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_temporary_lockout_log_replaced_with_event">Temporary lockout log replaced with event</h3> -<div class="paragraph"> -<p>There is now a new event <code>USER_DISABLED_BY_TEMPORARY_LOCKOUT</code> when a user is temporarily locked out by the brute force protector. -The log with ID <code>KC-SERVICES0053</code> has been removed as the new event offers the information in a structured form.</p> -</div> -<div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/docs/24.0.0/upgrading/">Upgrading Guide</a>.</p> </div> </div> +<h2>Upgrading</h2> +<p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> + + + https://www.keycloak.org/2023/03/keycloak-2101-released + Wed, 1 Mar 2023 00:00:00 GMT + Keycloak Release + + + + Keycloak 21.0.0 released + https://www.keycloak.org/2023/02/keycloak-2100-released + <p>To download the release go to <a href="https://www.keycloak.org/downloads.html">Keycloak downloads</a>.</p> + + <h2>Release notes</h2> <div class="sect2"> -<h3 id="_updates_to_cookies">Updates to cookies</h3> +<h3 id="_operator_deploys_nightly_build_instead_of_24_0_0">Operator deploys nightly build instead of 24.0.0</h3> <div class="paragraph"> -<p>Cookie handling code has been refactored and improved, including a new Cookie Provider. This provides better consistency -for cookies handled by Keycloak, and the ability to introduce configuration options around cookies if needed.</p> -</div> +<p>Due to an issue in the release process when deploying Keycloak using the Operator it installed the <code>nightly</code> container +instead of <code>24.0.0</code>.</p> </div> -<div class="sect2"> -<h3 id="_saml_user_attribute_mapper_for_nameid_now_suggests_only_valid_nameid_formats">SAML User Attribute Mapper For NameID now suggests only valid NameID formats</h3> <div class="paragraph"> -<p>User Attribute Mapper For NameID allowed setting <code>Name ID Format</code> option to the following values:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</code></p> -</li> -</ul> +<p>As a quick fix to the issue, the <code>24.0.0</code> container was tagged with <code>nightly</code>, and the <code>nightly</code> releases was temporarily +disabled.</p> </div> <div class="paragraph"> -<p>However, Keycloak does not support receiving <code>AuthnRequest</code> document with one of these <code>NameIDPolicy</code>, therefore these -mappers would never be used. The supported options were updated to only include the following Name ID Formats:</p> -</div> -<div class="ulist"> -<ul> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code></p> -</li> -<li> -<p><code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code></p> -</li> -</ul> +<p>If you installed or upgraded to <code>24.0.0</code> using the Operator before 5pm CET yesterday the database may have been updated +with the wrong versions. To check if you are affected connect to your database and run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>SELECT * from migration_model WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_different_jvm_memory_settings_when_running_in_container">Different JVM memory settings when running in container</h3> -<div class="paragraph"> -<p>Instead of specifying hardcoded values for the initial and maximum heap size, Keycloak uses relative values to the total memory of a container. -The JVM options <code>-Xms</code>, and <code>-Xmx</code> were replaced by <code>-XX:InitialRAMPercentage</code>, and <code>-XX:MaxRAMPercentage</code>.</p> </div> <div class="paragraph"> -<p>For more details, see the -<a href="https://www.keycloak.org/server/containers">Running Keycloak in a container</a> guide.</p> +<p>If the above returns a matching row you will need to take some actions, otherwise database migrations will not run for +future releases. To resolve this run the following SQL command:</p> </div> +<div class="listingblock"> +<div class="content"> +<pre class="highlight"><code>UPDATE migration_model SET version = '24.0.0' WHERE version = '999.0.0';</code></pre> </div> -<div class="sect2"> -<h3 id="_gelf_log_handler_has_been_deprecated">GELF log handler has been deprecated</h3> -<div class="paragraph"> -<p>With sunsetting of the <a href="https://github.com/mp911de/logstash-gelf">underlying library</a> providing integration -with GELF, Keycloak will no longer support the GELF log handler out-of-the-box. This feature will be removed in a future -release. If you require an external log management, consider using file log parsing.</p> </div> </div> <h2>Upgrading</h2> <p>Before upgrading refer to <a href="https://www.keycloak.org/docs/latest/upgrading/index.html#migration-changes">the migration guide</a> for a complete list of changes.</p> -<h2>All resolved issues</h2> - - -<h3>New features</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/15190">#15190</a> RestAPI endpoint "send-verify-email" sending execute actions email template. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19586">#19586</a> @keycloak/keycloak-admin-client doesn't provide an ability to use optional client scope for access token <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23539">#23539</a> User profile attributes should only accept a single value unless configured otherwise <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25167">#25167</a> Implement POST logout in Keycloak JS <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25446">#25446</a> CORS SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25676">#25676</a> Introduce new CLI config options for Infinispan remote store <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25702">#25702</a> Encrypt network communication in JGroups <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25733">#25733</a> Update Route53 HA guide to be compatible with ROSA and Openshift 4.14.x <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25903">#25903</a> Create new landing page for admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25941">#25941</a> Issue Verifiable Credentials in the JWT-VC format <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26028">#26028</a> Remove conditional statements about Windows / Linux from the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26250">#26250</a> OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26455">#26455</a> Supported option to specify maximum threads used to handle HTTP requests <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26456">#26456</a> Supported option to specify resource management for pods in Keycloak CR <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26458">#26458</a> Support custom Infinispan configuration file in Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26460">#26460</a> Supported option to specify site name for multi-site deployments <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26500">#26500</a> Cookie Provider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26936">#26936</a> Support EC Key-Imports for the JavaKeystoreKeyProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27186">#27186</a> Meta description of admin-ui and account-ui cannot be changed in theme.properties <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Enhancements</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9508">#9508</a> Rename "Resident key" to "Discoverable Credential" <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9758">#9758</a> User attributes with a text more than 255 characters <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/9784">#9784</a> Add truststore options to Keycloak CR <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/10794">#10794</a> Support importing Kubernetes CA <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12009">#12009</a> Support for scope parameter in the refresh flow <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12352">#12352</a> Align Operator config naming with Quarkus distribution <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/12946">#12946</a> Add X509 thumbprint to JWT when using private_key_jwt <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13250">#13250</a> --verbose option doesn't work in Quarkus distribution <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15000">#15000</a> Add EdDSA/Ed25519 to WebAuthn Signature algorithms <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/15714">#15714</a> Supporting EdDSA <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16629">#16629</a> Increase the default iterations for Pbdkdf2-256/512 to match the updated OWASP recommendations <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17574">#17574</a> Add failedLoginNotBefore field to existing brute force detection status API <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17735">#17735</a> Admin-UI: Show realm display name in realm drop down instead of realm id if available <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19190">#19190</a> Add "amr" to already implemented "acr" support <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19285">#19285</a> Disable Groovy Closures when bootstrapping Picocli <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20125">#20125</a> Role mapping tab no longer visible when using fine grained permissions after upgrade from 20.0.3 to 21.0.2 <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21074">#21074</a> Identity providers: pagination in admin console <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21343">#21343</a> Upgrade welcome theme to PatternFly 5 <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21559">#21559</a> Provide raw OpenAPI specification alongside Keycloak Admin REST API html documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21578">#21578</a> Scope parameter in Oauth 2.0 token exchange <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21771">#21771</a> List reload button for admin panel <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22436">#22436</a> Query users by 'LDAP_ID' is not working <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22922">#22922</a> Use Infinispan BOM instead of direct Infinispan dependencies <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23057">#23057</a> Localization tabs <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23431">#23431</a> Allow user to select between `Forwarded` or `X-Forwarded-*` header <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23470">#23470</a> Docs: authorization_services/topics/service-authorization-obtaining-permission.adoc <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23854">#23854</a> Use upstream Quarkus functionality for non-blocking probes <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23878">#23878</a> User profile configuration scoped to user-federation provider <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23896">#23896</a> Changes in declarative user profile should result in admin events <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24094">#24094</a> Map Store Removal: Delete map profiles from testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24097">#24097</a> Map Store Removal: Delete container providers that were added to the base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24102">#24102</a> Map Store Removal: Delete Profile.Feature.MAP_STORAGE and all its usages <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24103">#24103</a> Map Store Removal: Delete GlobalLockProvider <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24105">#24105</a> Map Store Removal: Rename Legacy* classes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24107">#24107</a> Map Store Removal: Revert deprecated modules in model/legacy and rename "legacy" to "storage" <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24148">#24148</a> Add config property to specify a list of truststores <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24202">#24202</a> Cache stampede after client invalidation <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24245">#24245</a> Parse default UserProfile configuration in the build time <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24250">#24250</a> Allow selecting attributes from user profile when managing token mappers <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24344">#24344</a> Enhance error logs and error events during UserInfo endpoint and Token Introspection failure <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24412">#24412</a> Accessibility of 2FA method selection <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24422">#24422</a> UMA 2 not evaluating as expected when using permission tickets <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24424">#24424</a> Query on update the ADFS FederationMetadata.xml on the keycloak instead of delete and recreating the IDP config #24310 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24567">#24567</a> Map Store Removal: Revert changes related to map store in test classes in base testsuite <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24668">#24668</a> Features versioning <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24793">#24793</a> Map Store Removal: Remove `LockObjectsForModification` <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24798">#24798</a> Add truststores to keycloak cr <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24860">#24860</a> Initialize Infinispan earlier in the build chain <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24926">#24926</a> Add polish translations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24995">#24995</a> Avoid deprecated API usage in testsuite/integration-arquillian/tests/base <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25058">#25058</a> Add Polish Translations to Account UI <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25074">#25074</a> Update Kerberos provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25075">#25075</a> Update SSSD provider for user-profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25103">#25103</a> Remove product from server info <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25113">#25113</a> Add a test for the LoadBalancerCheck <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25146">#25146</a> Decouple "factory" methods from the "provider" methods on UserProfileProvider implementation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25149">#25149</a> Replace the existing themes with the dynamic templates from user profile <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25236">#25236</a> Documentation about Australia Consumer Data Right security profile <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25238">#25238</a> Add missing Arabic messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25287">#25287</a> Upgrade Infinispan to 14.0.21.Final <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25288">#25288</a> Map Store Removal: Remove protostream dependency <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25300">#25300</a> Deprecate offline session preloading <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25308">#25308</a> Map Store Removal: Revert changes made to backchannelLogout <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25309">#25309</a> Map Store Removal: Remove ResponseSessionTask <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25314">#25314</a> Supporting OAuth 2.1 for confidential clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25315">#25315</a> Client policies : executor for enforcing DPoP <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25316">#25316</a> Supporting OAuth 2.1 for public clients <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25328">#25328</a> Tests for client scopes/evaluate tab are missing <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25375">#25375</a> Extra tests for realm roles <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25388">#25388</a> Enable concurrent remote operations for Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25403">#25403</a> Implements attributes field in KeycloakProfile interface <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25404">#25404</a> Adapt incremental build for latest changes in themes module <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25415">#25415</a> Describe how to use Infinispan Batch CRs for automation with the external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25416">#25416</a> Update UserProfileProvider.setConfiguration to accept UPConfig instead of String <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25487">#25487</a> Add extra tests for realm-settings in admin-ui <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25637">#25637</a> Client policies: executor for validate and match a redirect URI <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25638">#25638</a> Keycloak native implementation of SD-JWT <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25666">#25666</a> [Admin UI] Allow to customize built-in components administration UI via ConfiguredProvider <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25691">#25691</a> More info on UserProfileContext <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25738">#25738</a> Tooltips improvements when configuring user profile attribute <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25770">#25770</a> X509 client certificate login label extends out of form <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25823">#25823</a> Ability to declare a default "First broker login flow" per Realm <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25872">#25872</a> Make the `user` attribute available to the `idp-review-user-profile.ftl` template <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25882">#25882</a> RealmResourceProvider is not working as expected since version 23.0.0 <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25897">#25897</a> Admin UI: Show realm display name on welcome page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25908">#25908</a> Could not format default value for log formats <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25915">#25915</a> Make more clear in the documentation that the wait time is only increased on multiples of the max number of failures <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25935">#25935</a> Create Infinispan metrics with labels instead of long metric names <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25962">#25962</a> Missing localization of cs+sk messages <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25979">#25979</a> User profile attribute names with strange characters <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25985">#25985</a> Enable verify-profile required action by default <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26068">#26068</a> Reduce internal unsupported options in the Keycloak HA documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26083">#26083</a> Change RHDG references to Infinispan <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26092">#26092</a> Do not use raw parameterized PropertyMapper <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26146">#26146</a> Migration docs for https://github.com/keycloak/keycloak/issues/15190 <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26172">#26172</a> Permanently lock users out after X temporary lockouts during a brute force attack <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26198">#26198</a> Comprehensive log for the LoggingDistTest and Quarkus IT <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26220">#26220</a> Don't differentiate Windows for getting started <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26223">#26223</a> Use `--http-max-queued-requests` option in Keycloak HA documentation <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26241">#26241</a> Do not use general debug log level for tests <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26315">#26315</a> Fully remove reasteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26320">#26320</a> Allow formating numbers when rendering attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26325">#26325</a> Remove unused HttpResponse.setWriteCookiesOnTransactionComplete <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26402">#26402</a> Improve wording in Concepts for configuring thread pools section in documentation <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26416">#26416</a> Remove support for old cookie path <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26430">#26430</a> Implement stricter controls at token endpoint for PKCE verification <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26457">#26457</a> Remove support for multiple AUTH_SESSION_ID cookies <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26469">#26469</a> Documentation for verify-profile required action enabled by default <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26485">#26485</a> Add missing Arabic translations <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26489">#26489</a> Ability to have alternative default user-profile configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26530">#26530</a> Map Store Removal: Remove `RealmModel` from authorization services interfaces <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26552">#26552</a> Do we need to hide "required" settings for email? <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26570">#26570</a> Upgrade liquibase to 4.25.1 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26585">#26585</a> Improve UX of read-only attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26587">#26587</a> Documentation for SuppressRefreshTokenRotationExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26589">#26589</a> Allow Case-Insensitive Search on Provider Info Page in Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26598">#26598</a> Map Store Removal: deprecate model legacy module <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26626">#26626</a> Brute force detection should issue event for temporary lockout <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26634">#26634</a> Documentation for default validation changes due user-profile enabled <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26683">#26683</a> Remove explicitly set `lit-element` version <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26689">#26689</a> Update Maven dependency versions for docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26701">#26701</a> Upgrade to Quarkus 3.7.1 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26730">#26730</a> Add Multi-AZ Aurora DB to CI store-integration-tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26776">#26776</a> Update documentation to use new Infinispan configuration options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26781">#26781</a> Update HA guide about non-blocking probes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26810">#26810</a> Shorter lifespan for offline session cache entries in memory <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26812">#26812</a> Upgrade to embedded Infinispan 14.0.24 <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26819">#26819</a> Use version specific tag for Keycloak images in the docs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26859">#26859</a> Upgrade to Quarkus 3.8 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26898">#26898</a> User profile: Add regression test for select inputs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26910">#26910</a> Keycloak Operator should add service-ca.crt to the truststore <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26916">#26916</a> Upgrade to Quarkus 3.7.2 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26919">#26919</a> doc: add a clear mention in the documentation about the storage of the refresh and access token <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26921">#26921</a> Use latest OLM version for Operator CI <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26929">#26929</a> Ignore unrecognized truststore formats if `--truststore-paths` is a directory <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26967">#26967</a> Aurora Postgres IT: Upload flaky and surefire test reports <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27036">#27036</a> Upgrade to Quarkus 3.7.3 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27048">#27048</a> Add Amazon Aurora PostgreSQL to the list of tested databases <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27078">#27078</a> Update Keycloak HA Guide new resource limit settings <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27084">#27084</a> Remove the preview note from Keycloak's HA guide <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27093">#27093</a> "Open ID Connect" in docs / UIs should be "OpenID Connect" <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27105">#27105</a> Add New User Registration Option on WebAuthn Authentication UI <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27121">#27121</a> Remove references to Quarkus docs and absolute URLs from HA Guide docs <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27123">#27123</a> Use AWS JDBC Wrapper in CI tests <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27125">#27125</a> Add warning about too long attribute values <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27143">#27143</a> Distinguish user registration action label from the security key registration action's one <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27147">#27147</a> Replace "Security Key" with "Passkey" in WebAuthn UIs and their documents <span class="badge bg-secondary">keycloak authentication/webauthn</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27148">#27148</a> Allow overriding the default validators added to attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27169">#27169</a> Tweak the default memory request and limit in the Operator <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27190">#27190</a> a11y improvements on login page <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27226">#27226</a> Upgrade to Quarkus 3.7.4 <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27238">#27238</a> Add option to clients to use lightweight access token <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27280">#27280</a> Upgrade to Infinispan 14.0.25 <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27281">#27281</a> Allow option of using client_id instead of id_token_hint with RP-initiated logout in brokered IDP config/call. <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27315">#27315</a> Change docker image to container image <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27324">#27324</a> Remove RHSSO product documentation from upgrading guide <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27326">#27326</a> Edit Keycloak 24.0 release notes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27327">#27327</a> Harmonize behaviour of different CertificateUtilsProvider implementations <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27440">#27440</a> Edit Keycloak 23.x Release Notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27452">#27452</a> Edit Keycloak 24 Upgrade guide <span class="badge bg-secondary">keycloak </span></li> -</ul> - -<h3>Bugs</h3> -<ul> -<li><a href="https://github.com/keycloak/keycloak/issues/9871">#9871</a> Remove Infinispan workarounds introduced to prevent deadlocks <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/11178">#11178</a> Event for MISSING_REQUIRED_DESTINATION with idp brokering incorrectly says error is related to logout even for a login response <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13080">#13080</a> Encoded token stored as KC_RESTART cookie uses weak algorithm- HS256 <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/13368">#13368</a> Issue when using DenyAuthenticator in direct-grant flow <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14448">#14448</a> Multiple failures in OfflineServletsAdapterTest (testServlet, testServletWithConsent, testServletWithRevoke) <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14581">#14581</a> HTTP Redirect 303 to wrong URL (in case port is not 80) when trailing slash is not added <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/14776">#14776</a> Mail verification isn't working for multiple accounts in one session (only on auto login by clicking the verification mail, not by logging in with the credentials) <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/16260">#16260</a> Incorrect handling of OptionParserException in kcadm <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17155">#17155</a> UPDATED_PASSWORD user action shouldn't be triggered when login with linked IdP <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/17449">#17449</a> Removing the Realm ID and saving causes the realm to be vanished from the list of the realms <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19183">#19183</a> token-exchange does apply clientScopes of the origin client <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19294">#19294</a> Error on starting keycloak when foldername contains ")" using kc.bat. <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/19886">#19886</a> Allow configuration cookies with `SameSite=Strict` for better compliance with strict regulations and standards <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20304">#20304</a> When choosing resources in scope-based permission, multiple resource can be selected but only one will be visable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/20867">#20867</a> Control redirect after password reset <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21127">#21127</a> During password reset, the baseURL is not shown on the info page after browser restart <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21151">#21151</a> Realm import stack overflow <span class="badge bg-secondary">keycloak import-export</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21409">#21409</a> Brute Force Detection is disabled when updating frontenUrl via admin client <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21542">#21542</a> Context path missing in URL on OTP page to switch between QR code and manual code <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21730">#21730</a> v 22.0.0 - when creating a new realm the registration flow does not have terms and conditions step <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/21951">#21951</a> Unable to use `<` as part of a password <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22082">#22082</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceClientSessionsMultipleNodes <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22401">#22401</a> Common resources in Welcome page didn't resolve correctly <span class="badge bg-secondary">keycloak welcome/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22431">#22431</a> Localization: Admin UI doesn't pick up message bundles from realms other than master <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22507">#22507</a> User profile attributes not localized in account console V3 <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22540">#22540</a> Description of "Configuring sources for Keycloak" inconsistent / misleading <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22555">#22555</a> Docs: server_development/topics/identity-brokering.adoc <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22660">#22660</a> Implementing custom ClientAuthenticator loses access to Client Secret Input Field in the Admin UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22691">#22691</a> Flaky test: org.keycloak.testsuite.forms.RecoveryAuthnCodesAuthenticatorTest#test03AuthenticateRecoveryAuthnCodes <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22836">#22836</a> Invalid redirect uri when identity provider alias has spaces <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22904">#22904</a> Flaky test: org.keycloak.testsuite.model.session.OfflineSessionPersistenceTest#testPersistenceMultipleNodesClientSessionAtSameNode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/22958">#22958</a> KeycloakErrorHandler NullPointerException String.toLowe rCase() because message is null <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23023">#23023</a> Undocumented change in priority of X-Forwarded-* headers as of Quarkus distribution <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23056">#23056</a> Flaky test: org.keycloak.testsuite.admin.concurrency.ConcurrencyTest#testAllConcurrently <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23217">#23217</a> NoSuchFileException with ${kc.home.dir} on Windows <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23229">#23229</a> Realm client update via PUT returns invalid registration_client_uri with duplicated client ID in address <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23268">#23268</a> New Install with MySQL failing with REALM_SOCIAL_CONFIG ADD issue <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23399">#23399</a> Audience is lost after refreshing a RPT <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23683">#23683</a> Default-Value in UI for krbPrincipalAttribute is error prone <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23699">#23699</a> Account v3 theme - Localization not working on account console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23786">#23786</a> Failure: FipsDistTest <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/23966">#23966</a> Group members are displayed incorrectly when using LDAP in READ_ONLY mode <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24082">#24082</a> Selected locale is not taking into accoun in `keycloak.v3 account` theme <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24141">#24141</a> LDAP user mapper for username: user appears twice in the GUI <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24144">#24144</a> Unable to locate entity descriptor: org.keycloak.examples.domainextension.jpa.Company <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24200">#24200</a> NPE in User Session Note mapper on Token Exchange <span class="badge bg-secondary">keycloak token-exchange</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24219">#24219</a> admin-fine-grained-authz + client authorization settings requires view-client role <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24323">#24323</a> Refresh request ignores scope parameter from refresh request <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24353">#24353</a> Keycloak operator tries to manipulate Secret which is not managed by Keycloak <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24361">#24361</a> Adding scopes via registration_client_uri does not work when using Dynamic Client Registration <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24369">#24369</a> UpdateUserLocaleAction does not trigger EventType.UPDATE_PROFILE event <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24459">#24459</a> Keycloak fails to start when uninstalling custom provider <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24464">#24464</a> Tabbing is not working in forms inside dropdown <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24485">#24485</a> NullPointerException when key is not available in the database <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24506">#24506</a> Reopening 2 - CVE-2023-21971 - Update Connector/J to 8.0.33 <span class="badge bg-secondary">keycloak dependencies</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24508">#24508</a> Deadlock when pre-loading remote sessions from external Infinispan <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24595">#24595</a> Leaving Single Sign Out page open for too long and then confirming logout leads to error page <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24626">#24626</a> Upgrade testsuite to use SpringBoot 2.7 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24651">#24651</a> Deleting a User or User Group might cause that all users suddenly get the permissions of the deleted user. <span class="badge bg-secondary">keycloak authorization-services</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24652">#24652</a> SAML decryption fails if keycloak.saml.deprecated.encryption flag is set <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24718">#24718</a> Mapper Option "Add to access token" Toggled Off Despite Claim Added to Token <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24767">#24767</a> Improve LDAP Condition implementations <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24783">#24783</a> Keycloak Admin UI - Help text not localized in Realm Events Setting UI <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24923">#24923</a> Importing Keycloak breaks typescript in esModule <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24960">#24960</a> OpenAPI spec doesn't match the admin API <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24961">#24961</a> Keycloak not able to handle multiple validating X509 certificates when public key are the same <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24980">#24980</a> The `DefaultActionToken` serializes a JSON Object with duplicate keys <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/24986">#24986</a> `getMultiPartFormParameters()` always returns `EmptyMultivaluedMap` after upgrade to Resteasy Reactive <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25001">#25001</a> Client redirect_uri check must be compared using exact string matching <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25016">#25016</a> Make password visibility css classes configurable for themes <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25033">#25033</a> Typo in the balloon help of SAML Username Template Importer <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25041">#25041</a> Incomplete Spanish translations for Admin UI <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25051">#25051</a> Unexpected Application Error when clicking "Cancel" on user creation page <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25054">#25054</a> Read Only Access of the realm users' "Role mapping" tab is broken for Admin Console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25060">#25060</a> fix debug log string <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25078">#25078</a> Log Injection during WebAuthn authentication/registration <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25096">#25096</a> Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25110">#25110</a> User Profile attribute with "Options" shows options of another attribute if none set on it <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25111">#25111</a> RealmAdminResource.getGroupByPathGroup does not work with space in path parameter <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25173">#25173</a> Make sure username is lowercase when normalizing attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25183">#25183</a> NullPointerException thrown for UPConfig.getGroups() <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25208">#25208</a> GH Actions -> Keycloak CI -> MSSQL docker images fails during startup <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25231">#25231</a> CIBA and PAR are broken since 23.0.0 (NPE) when using http protocol <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25235">#25235</a> Unable to start after updating Docker container <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25290">#25290</a> Social Login Tests unable to retrieve Federated Access Token from user session <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25294">#25294</a> Kerberos principal attribute not found on LDAP user - even if kerberos authentication is off <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25322">#25322</a> Warning "Event object wasn't available in remote cache" when using remote store <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25392">#25392</a> Admin Console: Realm Dropdown should only show the realms the user has access to <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25417">#25417</a> Avoid keycloak-admin-client in UI to call admin console UI extension <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25423">#25423</a> Confusing error message by pr-backport.sh when not authenticated to gh <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25433">#25433</a> Key provider UI issue while saving - RSA <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25449">#25449</a> Clean up translations for DE/EN/NL for a first test-run of Weblate <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25451">#25451</a> Admin cli failing when adding roles to a 3rd group in a list <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25463">#25463</a> Unnecessary user profile metdata sent on user update <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25475">#25475</a> User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25502">#25502</a> Account v3 theme - theme.properties Custom theme scripts not loading <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25515">#25515</a> Deleting an atribute from the UI is reseting the unmanaged attribute policy <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25544">#25544</a> Post Logout Redirect URIs "+" behavior is inconsistent with other usages (i.e. Web Origins) <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25565">#25565</a> OpenAPI: POST for /admin/realms response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25566">#25566</a> Failure in SSSDUserProfileTest.test05MixedInternalDBUserProfile <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25584">#25584</a> iss not returned as query param in redirect to app when using "prompt=none" and user is not authenticated <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25601">#25601</a> OpenAPI: POST /admin/realms/{realm}/clients response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25604">#25604</a> OpenAPI: Client authz endpoints without responses <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25628">#25628</a> Translations missing in user details role mapping <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25633">#25633</a> Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25636">#25636</a> "Disable realm?" displayed when disabling client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25642">#25642</a> Failure in KeycloakDistConfiguratorTest's 'missingHostname' check <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25649">#25649</a> OpenAPI: In ClientRepresentation the property oauth2DeviceAuthorizationGrantEnabled was not known by the API. <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25656">#25656</a> OpenAPI: POST /admin/realms/{realm}/clients-initial-access response is 201 <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25660">#25660</a> Incorrect version of the fix in release notes <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25677">#25677</a> Removing all group attributes no longer works with keycloak-admin-client (java) <span class="badge bg-secondary">keycloak admin/client-java</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25679">#25679</a> `/admin/realms/{realm-name}/ui-ext/realms` endpoint leaks realms the user doesn't have access to see <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25699">#25699</a> Flaky test Job URL missing on some runs <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25704">#25704</a> Custom Validator is never executed when UserProfileContext is UPDATE_EMAIL <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25714">#25714</a> Flaky test: org.keycloak.testsuite.adapter.servlet.OfflineServletsAdapterTest#testServlet <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25731">#25731</a> /admin/realms/{realm}/groups Endpoint is slow <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25746">#25746</a> Using kcadm.sh create components result to 400 Bad Request <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25752">#25752</a> [CI] Store Model Tests failures - UserSessionProviderOfflineModelTest, OfflineSessionPersistenceTest, UserSessionInitializerTest <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25753">#25753</a> Backchannel logout token is missing the "exp" claim <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25783">#25783</a> Since 23, start-dev command line arguments parsing is buggy <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25789">#25789</a> User events: labels overlap content <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25827">#25827</a> admin ui uses hyphen instead of dot as realm attribute separator <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25853">#25853</a> Timeouts after upgrade of download action v4 <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25878">#25878</a> HTML emails in Catalan don't contain links <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25883">#25883</a> ldap-group-mapper fails when empty member: attribute is present <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25891">#25891</a> Optimize handling of terms and conditions during registration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25892">#25892</a> Test suite depends on artifacts built only when distribution profile is active <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25909">#25909</a> Keycloak HA Guide uses token for cross-site setup that expires <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25912">#25912</a> LDAP federation reports "Creating new LDAP Store..." on every login <span class="badge bg-secondary">keycloak ldap</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25927">#25927</a> UI crash after using breadcrumb group navigation during an active group search <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25934">#25934</a> On invalid submission, IdpUsernamePasswordForm sends back the user to the standard UsernamePasswordForm template <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25939">#25939</a> Declartive user profile. When multiple attributes with options validator are defined and 1 is selected on UI shown that 2 of them have values. <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25951">#25951</a> Masthead tests fail often <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25961">#25961</a> Native SQL Schema names broken on MySQL <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25977">#25977</a> No error message displayed when trying to add read-only attribute to some user in `Attributes` tab <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25980">#25980</a> Force reauthentication is ignored during identity brokering when mapping between OIDC and SAML protocols <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/25981">#25981</a> GitHub Status check is green if the build fails <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26021">#26021</a> `mvn clean` does not work in js directory <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26032">#26032</a> Duplicate tooltip/label for refresh button on device activity page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26036">#26036</a> subgroups clickopen not working <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26040">#26040</a> Subgroups-check is incorrect, and therefore subgroups are not clickable <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26051">#26051</a> Name ID Format field is confusing for User Attribute Mapper For NameID <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26052">#26052</a> Configure OTP Form regenerates Secret on reload <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26059">#26059</a> Attempting to update settings for realm with "dots" in the name fails due to client side validation <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26060">#26060</a> Various Localization tab issues <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26075">#26075</a> Next time you start message references the wrong command <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26088">#26088</a> Rest custom JAX-RS resource in kc 23: Method not allowed <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26131">#26131</a> Localization: Realm overrides subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26132">#26132</a> Localization: Effective message bundles subtab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26148">#26148</a> Keycloak JavaScript CI: client_scopes_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26156">#26156</a> A11y critical violation in ProviderId form field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26168">#26168</a> KC_DB_DRIVER is not propagated properly <span class="badge bg-secondary">keycloak admin/cli</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26177">#26177</a> Invalidate authentication session on repeated OTP failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26180">#26180</a> Invalidate authentication session on repeated Recovery Code failures <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26228">#26228</a> With fine grained permissions enabled, the grouptree rights check is not working correctly <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26231">#26231</a> keycloak-admin-client missing recent changes to group query parameters <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26236">#26236</a> Ensure community-maintained translations are not part of product build <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26266">#26266</a> Importing Realm with declarative user profile attributes fails <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26281">#26281</a> Incorrect example in the Keycloak operator configuration <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26291">#26291</a> Workflow failure: FIPS IT - KcSamlEncryptedIdTest#testEncryptedElementIsReadableInDeprecatedMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26295">#26295</a> Incomplete Chinese Translation for Login Page <span class="badge bg-secondary">keycloak translations</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26308">#26308</a> Error when migrating from a realm where the user profile component does not hold any entry in the configuration <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26323">#26323</a> Reset credentials action fails when triggered from first broker login flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26330">#26330</a> HTTP status code 413 Request Entity Too Large for large SAMLResponse since Keycloak 23 <span class="badge bg-secondary">keycloak saml</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26334">#26334</a> Resource and permission titles missing for a new client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26335">#26335</a> Bind flow modal broken <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26337">#26337</a> Write tests to cover binding a flow <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26350">#26350</a> Fix more A11y violations <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26358">#26358</a> Apparently incorrect tooltip on "type" field for a "resource" in a client <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26363">#26363</a> Search dialog for authorization policy is wrong? <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26374">#26374</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26375">#26375</a> The role Unassign button enabled in admin console even if no roles are selected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26383">#26383</a> Labels for WebAuthN missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26390">#26390</a> More A11y Violations Detected <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26400">#26400</a> Workflow failure: Admin UI E2E - realm_test.spec.ts <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26407">#26407</a> Typo in disable dialog <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26409">#26409</a> Duplicate `key` for credentials on sign in page <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26418">#26418</a> Failed to link identity broker to user with a verified email by IdP email verification flow <span class="badge bg-secondary">keycloak identity-brokering</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26420">#26420</a> Labels for WebAuthN Passwordless missing in Account Console <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26427">#26427</a> Operator CSV uses wrong format for `createdAt` field <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26452">#26452</a> Row remains selected when "cancel" clicked on deleting translation in the Localization/Realm Overrides tab <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26464">#26464</a> "Test connection" on LDAPS URI does not test TLS handshake <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26468">#26468</a> SPI-truststore-file-type option appears to be invalid <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26490">#26490</a> Update Keycloak sizing guide after change of default hashing configuration <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26507">#26507</a> Failed to link the user with an existing read-token role from the federation provider when AddReadTokenRoleOnCreate was enabled for the IdP. <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26529">#26529</a> Workflow failure: Quarkus IT - FipsDistTest#testUnsupportedHttpsPkcs12KeyStoreInStrictMode <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26549">#26549</a> Mysterious settings changes due to Keycloak cluster changes <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26564">#26564</a> Issues related to IDNHomographValidator <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26584">#26584</a> User details locale select broken in realm specific admin console <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26588">#26588</a> Infinite loop during X509 authentication <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26597">#26597</a> Keycloak UI meets "Internal Sever Error" after save "Refresh Token Max Reuse" number <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26604">#26604</a> Arc container is null <span class="badge bg-secondary">keycloak dist/quarkus</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26609">#26609</a> allow sending realm in request without changing the kc admin object <span class="badge bg-secondary">keycloak admin/client-js</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26612">#26612</a> Wrong delete messages in Realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26618">#26618</a> CLIENT_ATTRIBUTES index idx_client_att_by_name_value no longer exists since KC 20 (postgres) <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26631">#26631</a> Keycloak HA guide with blank and callout <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26635">#26635</a> Account UI ships too much Beer in user attributes <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26636">#26636</a> Immediately reflect flow binding status on flow definition page in Admin UI when binding an auth flow <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26643">#26643</a> Replace "message bundle" text to "translation" in realm overrides <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26649">#26649</a> PhantomJS does not send secure cookies over http://localhost <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26651">#26651</a> [keycloak.js] useNonce parameter is all-or-nothing <span class="badge bg-secondary">keycloak adapter/javascript</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26653">#26653</a> Disallow removing required filters when searching for effective message bundle. <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26665">#26665</a> Unable to modify access token lifespan at realm level. Keycloak stops working. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26668">#26668</a> Wrong help for "Create initial access token" expiration field <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26686">#26686</a> Not possible to build documentation after quarkus upgrade <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26697">#26697</a> When creating a user federation mapper changing the type doesn't change User Roles Retrieve Strategy <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26716">#26716</a> User Profile Applies Validation To Service Account Users <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26727">#26727</a> Auto layout of authenticator flow graph only applies the second time <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26747">#26747</a> Tooltip for attribute name in user-profile configuration is incorrect <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26750">#26750</a> Empty error message when validation issue due the PersonNameProhibitedValidator validation <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26782">#26782</a> Accessing userinfo fails with CORS when token is expired or session is deleted <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26790">#26790</a> Workflow failure: Operator IT on OpenShift <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26792">#26792</a> User profile 'uri' validator not working <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26816">#26816</a> Keycloak server admin docs needs change with the new hashing iteration changes <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26818">#26818</a> bug in operator example yaml <span class="badge bg-secondary">keycloak operator</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26826">#26826</a> Freemarker erroneously escapes/sanitizes URL in template.ftl (&amp;) <span class="badge bg-secondary">keycloak login/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26830">#26830</a> Duplicate "Refresh" buttons present in admin-ui <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26834">#26834</a> Disabling "Reset OTP" in "Reset credentials" flow throws error on "forgot password" <span class="badge bg-secondary">keycloak authentication</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26853">#26853</a> Fixing anchors in security apps guide in prod profile <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26856">#26856</a> Remove custom user attributes section in server developer guide <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26937">#26937</a> Once all default client scopes are deleted from the realm we can't create a new custom role. <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26941">#26941</a> When loading entries from a remote store at startup, no lifespan or expiry is set <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26951">#26951</a> Roles admin REST API for creating roles: Composite roles are expanded <span class="badge bg-secondary">keycloak admin/api</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/26983">#26983</a> Group not found in list after creation <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27002">#27002</a> Refresh doesn't work in Localization/Effective message bundles <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27005">#27005</a> Unable to approve/deny permission requests <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27031">#27031</a> Having read-only attributes stored at a user leads to validation warning on every login <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27095">#27095</a> Cache Keys for Group pagination and other entries cannot be invalidated and updated <span class="badge bg-secondary">keycloak infinispan</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27120">#27120</a> Microsoft social login failure <span class="badge bg-secondary">keycloak testsuite</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27133">#27133</a> Workflow failure: Keycloak CI - Store IT (aurora-postgres) <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27137">#27137</a> Users with fine-grained permissions can not create a user <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27140">#27140</a> Locale selector is unnecessarily visible without rights to locales <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27162">#27162</a> Default locale is set to null when not explicitly choosing a locale <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27173">#27173</a> Newly created authentication subflow is always disabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27234">#27234</a> Cannot update email in account console with `update-email` feature enabled <span class="badge bg-secondary">keycloak account/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27243">#27243</a> Account console not working when lightweight-access-tokens used <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27271">#27271</a> AuthorityKeyIdentifierExtension should be calculated from caCert (if it present) in generateV3Certificate, not from subjPubKeyInfo <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27284">#27284</a> FolderTheme does not support Locales with extensions <span class="badge bg-secondary">keycloak core</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27290">#27290</a> AWS JDBC driver throws ConcurrentModificationException <span class="badge bg-secondary">keycloak storage</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27297">#27297</a> Check for duplicated usernames and emails when Login with email option is enabled <span class="badge bg-secondary">keycloak user-profile</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27316">#27316</a> Server admin guide not building downstream due to missing IDs <span class="badge bg-secondary">keycloak docs</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27337">#27337</a> Workflow failure: Admin UI E2E - realm_settings_user_profile_enabled <span class="badge bg-secondary">keycloak admin/ui</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27344">#27344</a> Secure Redirect URI executor issues <span class="badge bg-secondary">keycloak oidc</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27345">#27345</a> Workflow failure: Keycloak CI - OAuth 2.0 Grant Type SPI <span class="badge bg-secondary">keycloak ci</span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27406">#27406</a> JavaDocs generation broken after removal of resteasy-core <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27409">#27409</a> Apply remote store workaround also for configuration via CLI options <span class="badge bg-secondary">keycloak </span></li> -<li><a href="https://github.com/keycloak/keycloak/issues/27412">#27412</a> OAuth 2.1 default profile lacks oauth-2-1-compliant setting for SecureRedirectUrisEnforcerExecutor <span class="badge bg-secondary">keycloak oidc</span></li> -</ul> - https://www.keycloak.org/2023/02/keycloak-2100-released Thu, 23 Feb 2023 00:00:00 GMT